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Tin is ijiuphr r-a^arts «n protirti&s in thu ^avfiHoDnent; 9f & [mn^tor fvr 
debugging elenjentar; pro grans. Suuh ra^s^rzi) is iHiH^rtKnt r>i>th for Its 
prficticfil stfiplltatlons &s. fr«]Ll es fcvr i^i iaire£tli}tLti<^ of conccipts 
which a^e rtiiid6itean^'£:{ Ut ot'^^fauaelnj; skiiJi, A (^,»iiipu&«r iaomltor c«il]Led 

||YCRd3FT ^JdS im^n 4^s:l^ed tiiat: can r^iiBJLr siapls praprsoiG Far dra'n'lnd 
pictures [EjtM'jAtaln 1(74]. The refl&un^; to devbicp m*ih [iKinltors arei 

1. ^0 prQv^dB ^ nori prBCi^s un.dBr^tand'lEig of the hAttlre of 

prog?' siiiBi Tig s|);,illai 

£r v«> ji'stHii^fate the devdopm-sfit at msiihin^i cue^bl^ uf 
n^bu,^^j.n$ i.n:d fexpbEicilnQ »p<th iii^ t^rogrwds givan thwit by 

3. to (jroc^fb insight iato iLlis praMau jfolviitg precast so 
fllftt It CE.P: be d^^crlbBd inorc iiufs struct lively to students^ 

E^VCRC^r i£ ^latdindad eo supn^ly ocfa&lan&l advice t;. d i;tud«nc ta aid 
%R tii'^ dubugi^iiig of programs that liu a^ry. (Ju^t tts C9i^ systetfii's 
!?iaRiesake^ Avf.fi^ti HojLiiii3«- occajti»neiliy ^L^pioll^d ad^flc^ to his younger 
brother ^^riC^K^lt. on particularly djft'iqult cas^;.^ In itiis interaction, 
th^ u^ar sLtFrj^^leis stati^itants that dss^rib^ ts pet: tit i3^f ttte intended 
pictuir« and j3i»n, and the syjstem fills in details *jf this cmnnientary, 
<tia9titi3.a:.^ b^-jt and su^^'Sstsi fiorrectloni^. ][[i Uiis ti^h^'frr. however, [ 
ahall not «tftp«5£ii.4:e this interactive role. Ins.teacJ, iny uriraary pvrpii^e 
vfLll b4 to d^&(;rj'.b« nVCROFT as a nocfeiJ. «f the debugyfingi iproce^^- This 
l£ ro&^ont.bl!f £.lnc« ?tVCR(rPT's utility a& an a(lv^.&uir stains dirfctly ifrciia 
its iaiid'3rs.it*irjii1,iiu) of dehugging £fctXJ.. 

MZKfJf'^^ ifi aiili3t to correct Che protji'ansi re^p^n^lhla for the buggect 
pictured ^Jinj^i JLtt figure & ]. .1, Lit ^-^ dud 1.3 itb ihdt the intended 
piciur^^ i^r? 3Lich jle v^d . In this paper p t^.aie debugging of figure 1 . i , a 



typical ax^mpla, will be thoroughly i^plalned, Flsures 1-3, l --4 and 1.5 
are corrscted in atialngous Hdys: i96 [Goldstein 1974 J for ^je^tdil-'^- 
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Picture drawn bj/ NAPOLEON 



FIGJRE 1.2 




INTENDED TREE 
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Picture dravi^n by 
bjgged TREE program 
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Pictufi drawn b bugg&d WtSHlfllaWELL 
progrM 



FIGURE 1.4 





Intertd&d 



Ptctuire (Srau'jn by bu^^i^d 



FIGURE 1 .S 



These plcturQS are drdntn by program aanlpulatlon cT a graphics 
device c^H^d the tu^rtjle wblth has a pen that can leav« a tract along 

the turtLfl^s jsath , Turtl^A pUy an important role in the Loao 
environment wtisre children le^rn problem solving an*3 mattiematici by 
prugrantling display turtles, iihy^ical turtles with various sensorsn and 
music boxes [Papert igjlj 1972 J. Tvrti* prograps have proven to be an 
excoll&nt starting point f-or t«achln^ jirograiMlng to ohlldrEn of all 
age^, and th«rcror« provid-« a r«a£i:>nal3l« initial prubleiD damaln fvr 
building a. program undsrstanding Jiysteni- 

Ttie contact of ^VCRI?FT'S activity ia the interaction of three kinds 
of closcrlptlon: graphlctl {l,a. the picture actually drawn), procedur^-tl 
(the turtle prograM used to geaerate fhe plcturi^) and predicative {tde 
col lection of statements used to d^iCrilig the desired S4::ene}. For 
MY CROFT J debu gging is jnafclng the procedural doscrlptlon prcrduce a 
graph iqal result that satUfl«s th* set of predicates d4acrlblng intent. 
ThU£, debugging here Is a process that nediates hotweon different 
r&pr&S^ntatiorts of the same object. 

J_i^l FLOWCHART OF THE SVSTEH 

The organizstlon of th€ monitor system is illustrated in figure l,€. 
Input to ffVCPPFT consists nf the user's prograns and a, TOPdel pf th« 
Intended outcome. For the graphics iforld, the nDdsl i& a Conjunction Df 
geoinetriE: predicates dBscrlbing important propnrtits of th# intended 
picture. MYCROrT tlien analyzes the program, building both a Cartesian 
annotation of the picture tbat is actually dra^m and a p_lan explaining 
th& r&latlonshlp hat^^'een the program and mcidel, [Any or all of the plan 
can bo supplied directly by the user, thereby simplifying MVCROFT's 
tasli, j 
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The next step Is Tor the system to liiterprel the program's 
IMrfonnnnca in t^has or the ngd^l ^nd produte a description of thft 
dlscrepfiTici«s> Thise dlscrttaneles are expresaed as a list af th^ 

violated, model statements. The task Is then for ttre debugger to repAlr 
each viDlacion. The final output is an edited turtle pro^rAm (with 
cspious csBftiehitary) which diatisfies th# iwdelr EOccaslonally, thip plan 
tJiat HVCRQFT hypptheslies requires ijnplausible repairi--riir examjile, 
major dELetions nf user code- -resulting in the debugger asking Iho pLan- 
flndor for a new olari.) 

The- rsinaiisder of this first section describes the debugging of 
NAPOLEON (figure I A) and introduces some inportant ideas about the 
nature or plans. Section Z deitribes the ajlnotato r used to document the 
performance of tyrtle prugrams. Section 2 introduces the ^anj finder 
and iLi^ctjlan 4 discusses the debugger - Section S concludes with 
suggestions for futurt research. 

To Judge the success of a prngram^ hYCROFT requires as input front 
the uiar a description of intent- A declarative language has been 
d-esignei to define picture models. These models specify important 
properties of the desired Tinal outcome 'Without Indicdtlny t]i& details 
of the dravfing process. The jjrimitiwfli of the mcKlel language ^re 
geometric predicates for siich properties tii connectivity, relative 
position, length and locattun. The following models are typical of 
those that the ussr ml^ht provide to desoribe figure lr2. 
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FlODEL T1AN ' '''^' ^ - - 

Ptl PARTS HEAB WW ARMS LEGS % .. 

nZ EQUITRl HEAD 

tii LINE BOCr ■' , 

Ft* V ARMS, V LEGS 

H5 COVWECTtD HEAO POOV , roW^ECTEO BODV ARMS, COtlHECTtP BQ&V LESS 

K& BELOW LECiS AKJIS, BELW MAS HEAD 

LND . , 

P60DEL V 

PI) PAfiTS LI U . \" 

HZ LI?JE LI, LINE Lg 

fti COSfMECTED LI L2 tVlA tWOPOlNTS) 

END ..... 

flOflEL EOLITH J 

Ml PARTS I SICE 3} tl^OTATKTSl i) 

nZ FOR-EACH SIOE (= (LEMOrH BIVL) IM ) 

H3 FOR-EACH ROTATION (= tOEOREES ROTATION) 120^ 

fl^^ RlNll COKfylCTEtJ SIDE 

EHG - ' . . : 

TTie KAN and V UHd'Als tn lihdvrdBti^rminEd: they do not describe, for 
example, the actual size tif Che pictures. The user has latitude in his 
descrtpclon Qt intent bflcausfl MVCROFT is dQsltjned only to deba;; proijruins 
that Are aLmOKt cerrecl:. Therefgr^^ not oTtly the oiiedel, byt alSiO thF> 
pi ct Lire drawn by th4 pr^^ran and the definition of the procedure provide 
clue^ ta the purpoEe of Che program. 



I,? THE WAPOLEON £XAMN.£ . . • 

HVCBOFT is designed, te repair a stmi*!* tlasa of prfltedur^a called 
FiK?(l- Instruction Programs. Tti«sB are prDCQdure^ in whii^'h the 
prinitives are restricted to constant Inputs, Sub-prccfldurcs are 
alloii^ed' howevfir, no conditionals, variables, recursions <jr iterations 
ar& permitted- Given be lew aro th* thr«« programs which drew figure 
1 . l-'NAPOLEON, VEE, an4 TllICORN, The ^<~' coDimentary is called the plan 
and was generatFd by PJVCIlCiFT to link th» picture nodels--NAN, V and 
EQUlTRl--to the programs. 
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TO NAPOLEOM 

ID VEE 

20 FORWARD 1*0 

30 VEE 

AH FORWARD 100 

BH LEFT 90 

601 TRICORM 

TO VEE 
10 RlOUT 4S 
ZO EACIt IQD 
3D FORWARD 100 
4D LEFT BO 
50 BACK lOQ 
60 FORWARD 100 
EWD 

TO TRICORN 

10 FORWARD 50 

£0 RIGHT 90 

30 FORWARD LOO 

^0 RIGHT eO 

SO FORUARI> ]QQ 

60 RICHT $0 

70 FORWARD S-O' 



<- (acc-ompHsh Ban) 

<^ UccompUsh legs) 

<- (^ccnapli^h [piece t body)) 

<- ( Insert arms hoiy) 

<- {accomi\l'Lt.t\ [olecfr Z boiJ^n 

<' (£«<tup }3'«'adlnc) [Tor he«d)> 

<.' (accmipli&h head) 



<- (actoinipliEh v) 

<- {setup heading for 11) 

<- <accomplisJi 11 ) 

<- [retrace 11} 

<' [SB tup hcadiflfl ftir 15 J 

<■ (accDinplish IZ) 

<- iTfttrace IZ) 



<- (accoapllsh eguitrU 

<- (acCDrtpli&b [pifrCfr 1 [sldQ 1)^ 

C- (accGinplisli (roCation 1)) 

<' (accmnc^lish [side ZH 

<- (accotfiDllsh (rotation Z)) 

<.- {accompli Eh (side 3)) 

C~ (accomplish (rotation 3}) 

<- {accomplish (piece Z (side iJ)J 



Tho turtle coraiwnd FQHHARil mov&s the turtl* in the dl recti on that i% 
is currcTitly pointed: R[GHT TDtaieA ths turtle clocXwlse around Its 
aKis. A ccapletfl dascrlotlon of LOOD C^n be fvund in [Ahelson 1974], 
but is not iieed«di tinre. 

A Cartesian representation of the picture ii gecierated by the 
afifietatsi' that describes the perfarmanca of the turtle prograB. Th* 
plan is used to bind 5Ub-pictures tn model parts. This isLIohs MVCROFT 
to interpret the prOffrSB with repect to the ■adal and produce a list of 
vipXated model s t a t emen ts , ffyCROFT produces the fDllann^ing Hit of 
discrepancies fer MlAPOLE[?N: 



(NOT lllUl BO[>V)) 
IKOT (BELOH LECS ARMS)) 
(WOT (BELOW ARH5 HEAD 3 3 
(MOT (FQUITRI TRICORN) 3 



iflhe body is not d Lln^. 

iThfi legs ere not beLcf the arms, 

;The arifli arfi nnt below the head. 

iThe head is not an equilateral triangle. 



MVfJRUI'T iSi able to correct these bugs and Achiave the lnten<lert picture 



QaliJsttin 10 introiJuiction 

using both planning and debugging kncwladga. 

1,4 PLANS 

Thii 3«ctinn intrnnliices a vpcatiijlary fur tulking ahnut tliR structsir? 
Df B prccedure Mhich is useful Tor tinder&tandini] both tht d«£lgin And 
debugging of prograDS. A lain -sta p is daflned as the code required to 
achlflvfl a partlculaF- sub-goal (sut^- picture), A preparat&ry-step 
consists of cade naedEd tD SBtup^ cleanup or interTacB betweeii tnain- 
&tep5^ Thus, frnn this pnint nf view, a pragrad Is understaad as a 
sequence of laain'Steps and preparatory-steps, A slnilar point of view 
is fipund iii [Sussman 1973J^ The plan ct^n^ists nf ths purposes linking 
pa:ln- -and preparatory-i^teps to the model: in the turtle world, ttie 
purpose of nain-steps 1& to ftccotnpLl^h (drai-iji parti of the model; and 
the purposQ of preparatory-steps is to projicrly setup or Cl-ainuj) th6 
turtle State between m;iin-j;teps or, perJiaps, to retrace over some 
previous vector. 

A poriular rnfljn-ntcp is a sequonce of contiguous code intended to 
accomplish & jjartlculur qd&L. This ±& as opposed to an intfrrupto<t 
naln-step wtvosn code is scattered in places throughout th« program. In 
NAPOLEONi the raaln-steps for the legs, arnts and head are iiladular^ 
hiowever, the C'Ode for the body is interrupted by the insertion of the 
cod« for th.e aras into Its fflldst. The utility of naking this 
distinction is that modular ma In -steps can often be debugged in private 
(i.e. by hfiing run independently of the r«inainder of the prncedure) 
while interrupted muin-st^ps coiBtonly fail b^cau^e of unror&een 
Interactions with the interlstved code associated with other steps oT 
tho plan. 



has two stages. th« Tint U Id brtak the task Intc indopendient sub- 
gaals and design 4«luti«n£ ([ii«ln--steE)& ) for @dcti, Thi« second l5 then to 

(fofllbin^ t^iese niain-steps iiitci ^ sin^flQ proceduro- by CDRcatgnatina tti4n 
into somt S'Squ^ncfi^ adding (wliBre necessary) pre paratory' steps to 
provide proper interfacing, the Virtue of this Ai>i>roach l& that it 
divides thfl probltB IfvIp manageable sutj-pr^bL^ins. A disadvantage is 
that acca^ionally there may bfr constrAlnts on the design of some naln- 
£t«p Which ar* not recognized when that step is designed independently 
qT the remainder of the problem. Another disadvantage is that linear 
do-Sign can fall to recognize opportunities far sub-rautinizing a ssgrnent 
of cofie useful for accDDplishing iDore thah ans BAin^sttp. A linear i>lan 
will be defined af a plan cnnsisting nnly of iDodular maln'Steps and 
preparatory stepsi & naft-llnMr plan nay tnclurtfi interrupted main-steps. 

1_._S LINEAR DE&lJGOINCi 

Linearity Is a pgwerrul concept for debuyyinQ as tfill as for 
designing pragrams. ftVCKOFT pUCSUfrS the fffUowing linear approach to 
correCtinii turtl4 program.';: the debugger's first gaal 1 s to fix each 
m^lln-step independently SO that th« code satisfies all :tntended 
propertlfifi of the model part being accMnpllshed. Following IhiSK the 
main-steps are treated as inviolate and relations between model parts 
are fi^ed by debugging preparatory-steps, Thi£ is riot the only 
debu^^ging techni'Uue avs.llabTe to the system^ but it is d valuable one- 
betaUSfl it ejTiLjOdles important heuristics (,1) cancernina the order In 
which vi^ilations should be repaired and i.t) for selecting the repair- 
point {iocation in the program-i at idlictl XMi fldtt for 99Ch violation 
should be attempted - 

following thij linear approach, PlYCROFT repairs the crooked body and 



the op?n hetid of NAPOLEON beCore correcting the BEL-OU re 1 a 1 1 an ii . 
Repairing thesE parts is done on the basis of knowltdge described in the 
n«xt tvo sections. Let us ajsuns For t^s remainder of thr^ section that 
these prOf»»rtV repairs have been made -^ NJirPOLEON appears as in figure^ 
1.7 '- anct concentrate on ttie debugging of the violated relatLons. 




NAPOLEON hrUJi parts correct&d 



FIGURE K7 




NAPOLEON with stoteinent }b 

as RIGHT T35 

FIGURE l,a 



Treating nain-stops 9% Inviolate and fixing relations by nodirying 
5CtUJ) Stfrpji limits Che rejiair of {BELOm LECS Mty\S) tc three possible 
rei^air-po-intsj U) hifgre the legs as statcnent 5^ tS) Before the first 
piece of tha body as statement 15 and (3) before accomplishing the amis 
as Statenent £5. nVCROFT understands enaggb about causality tQ l^now 
tnat there is no point in considering edits following the ojtecuttori of 
^tatnnent 30 to affect the arms or legs. The eltact changes to be made 
are d* terra in ad by imperative semantics for the mode J prtdtives • This 
Is pro<:edyral hnowledge that generates, for 9 given predicate an4 
loc^titrn In the program, some possible edits that wDi^Id make true the: 



violated prtd letter MYflRQFT generally con^idErs alternative strateejtes 
for correcting b. giv^n vinlationL it prefers thasE sdlti htilch i^roduce 
tht moit beneficial side effficti, maks minimal changes to the user's 
ctjde or most closely iitiify tTiQ abstract form of the plan. 

For BELOW, the Imperative semantics direct DfBlJG to place the legs 
below the arms by adding rotations at the setup Steps- Nar« drastic 
Diodif ICAtlons to the user'j code are possible such as the additir>n of 
position setups ^icli alt^r the topolo^^ «r the picture i however, 
MVCRQFT tries to be geTitle to the turtle progran {using the heuristic 
that thE uset's cflde Is lorobably almost correct) and considers larger 
changes to the pr&oram OEvly if tihe simpler edits do not succeed. The 
first setup location considered is the oflt imine^a iato ly prior to 
accQinplishina the arms. Inserting a rotatims as statenent Z5, houever, 
does not correct thfl violation and Is therefnrE rejEcted. The next 
possible edit point is as statement 15. Here, the Addition of (^ICiHT 1^5 
Bakes the legs f AJltLV-6EL0W tJli arms and produces figure 1.3, This *dlt 
Ls possible but Is not preferred both because the legs and arms now 
overlap and because the Legs are not COrtPLETELY-etLOW the arms. flVCROFT 
is cautious, being prinMirily a repairmin ratJ^er thsm » de'signer, and la 
reluctant to introduce new connections not described in the model. 
Also, given a choice, NVCRtiFT prefers the mctst cDnstraln'ed neanlng of 
the raodel predicate. If th^ us&r had intended fiirure 1.3, ihien une 
would ejtpfict the model description to Include additional declarations 
such as (CONNeCTED LEGS ARMS) and (PARTLV-BELOW 1EC=5 AR.1S> . 

Adding RIGHT 90 as Statement 5 achievss tCOaPLETELY-BELOW LEfiS AH.n&'i 
and the XAPOLtON program nnw producES the intahtled picture (figure l.ZJ. 
This correction hiS beneficial side effects in also establishing the 
proper relationshil) between the head and arms, confirmin'^ for MVCPtiFT 



that the edit is re-a^Dnabl^, alnc« a particulAr underlylh!) cau&« Ls 

often ro!>pnr>sitiU for Mny bugs. Thus thfl result of < DEBUG (BELOW LEGS 

ARHS^J is: 

5 RIGHT 90 <- (setup hoAdlng such-that (below legs ^rmsj 

(b«Low 4rni-s head}) 
Uisune (^ (entry heading) £7Q)) 

The assume commRnt rftcorfJs tlie entry stiite with respect to whicti the 
edit was mads. If ths prdgram Is run At a. future time in i. n^w 
envlranniBrit^ then debugging is sinpliried. The cause of i. EELOW 
vlQlaticTi vfill noK iHiEdiat^ly bfr i66a to be 4(1 inc«r^4ct assumption, 
and Che correspondlngi repair is obvious -^ insert cede to satisfy the 
6ntry requirements dttcrlbed: by thfr assumpticin. This illustrates the 
existence of lev«ls of ecmnefltary between the nodel flnri the prngram, 
•ach layer being mon specific, but Also nore {l4$«ly tl«d to the 
particular code and runtlae environment of the pr^grui. 

Linear debugging grea.tly restricts the possibilities that must be 
cansldered to repair a violation. It is nft(>n successful and 
constitutes a powerful first attack on the problem of fintJlng the proper 
edit; hQweVer^ It t& not lhfanible> !^><r.UJl*L^C ^"^S^ ^^le tn unexpected 
interacti'Ons between nia i n - steps would not be caugiht by this technique. 

Flguro 1,-9 1 Illustrates d non-linear bug, (IhJSlEiE m\il\i flEAD^ Is 
violated but it CKiinot be repaired by adjusting the Interface between 
these twe parts (indicated in figure 1,9 by the dotted linn OP) s.infio 
the mciuih Is longer than the diameter of the bead. The imperatiye 
sfiKtantics fer riKlnjj INSIDE r^cog^nize tbls. Cdns^ifuentl^, NfCROFT 
resorts to th« nor»-Ltnear technique of nodifylng main-steps to repair a 
relation betvetn parts. The Imperatiyi^ secuntics sua)]e£it cKanylng tlho 
size of one of tJle parts because this transfarErHttion does not affect the 
Ehttpe of the purt and consequently will probably not introduce nevT 




violations in properties describing the part. Advice Is required from 
thfi user to know ^ihether sJ^rlnking thi5 mouth is to bs ureferfeil t* 
eTtp^ndlng tha hc^d- Twc> qore ncn-Llnear d«t»u(fEllng[ tachnliques are 
d i sc u s ::i-e d In ttte n^Xt fWO sections i di^e is based upon knowirig the 
abstract farm of plans < and the other uses dQHId in' dependent theoreias. 
about global err«cts. 

i.6 [NS£RTiqN£ 

In prD'^raEDCDing^ an interrupt Is a break in norioal process In'g T-or tho 
puri>^0j* et adrvicing a AUfprise. Interrupts r«p resent an ioportant type 
of plarr; they are a necessary problea solving strategy when a procpss 
oust dsal with unpredictable events. Typical situations nher^ 
interrupts prove useful Include servicing a dynamic display, and 
arbitt-atln^ the cenflittlngp deridndS Of A time sharing iyst^rti. In the 
real world, biological creatures must use an Interrupt style of 
processing to deal with dangers nf their environment such as predators. 

A very simple tvpe of Interrupt Is one In wtiloh th« program 
associated with the interrupt is performed tar Its side effects and is 
s ta ta - traftsparftflt ^ I.e. the machine Is restored to Its pre -Interrupt 



stdtti bBfora ordinary procflsslng Is rcswm.'C^lr fts a result h the naln 
procc>$i$ rxevEr notices the In termptian . In the turtle Korld, uti 
andlot|ou& typo of organization Is that of an Inserted ma in -stop 
tinsartlon}. It naturally arlsES when tllfl turtle, while flctomplishing 
ane p&rt of a mod^l ttti« Interruptod naln-step), assumes an appropriate 
entry stat4 for another part (the insertion). An obvious planning 
strategy is ta insert a isib-procEdure at such a point in the executj.ci'n 
cf the' interrupted naln-step. Oft«n, the insertion will be ^tate' 
tr^insparent : For turtles^ this, is achlEVEd by restoring tTiE heading^ 
pojlCion an-cl pen st^te, The insertion of the arms intc the body by 
stdteinent 30 of NAPOLEfJN i£ an BxamplE tif a position' and pen~ l?Ut not 
hea'ding- trinsparent IniJflrtiDn^ 

Insertions do not shd,re all of the propertied af interrLipts. For 
exapple^ the ins-ertioh always o^cuf^ at a fixed point In the program 
rather than at sdoib arbitrary and unprBdi stable point In tinier Nor linr.!^ 
the Insertion alter the- state of the n«in Uroiress as bappens in an error 
handler. However, If one focus S«S on the planning process by which the 
u^er^s code was written p then the insertion as an Intervention in 
accomplish inti 4 main-step do a a hove the flavor of an i interrupt. 

The f INDPLAN module aids the debugger In i second way beyond just 
the gen ere t ion of Che plan. This is through tbe creation of caveat 
ccHiuBents to warn the debugger of suspicious Cpd^ thftt faili tO satisfy 
expectations based on the abstract form of the plan, In particular, if 
FlMDPLAN ab serves an insertion that is not transparent, then the 
follow! ng ca ve at is gen e r a t e d : 

30 VEE <- (caveat findplan (not (rotation-transparent IfisertJ j J - 
The non-transparent insertion nay have been irttentional^ e^g. the 
prpparation for the next piece of the Interrupted n« in -step taay hava 



b^cn jslac&d within the insertion. The user's prQ^ram may have itr^pAred 

for the next oifiLn-step withlTi the Insertion, Hencs, FINDPLAN does not 
immediately attempt to correct the Anoaaleu^ code. Only If ^ut^sequent 
dtrbLiijsitiiO oT scna model violation ccfifir^s the caveat is the code 
corrected. There -will eften be najiy pO^sibl^ corrections tor ■ 
particular modal violation , The caveat is used to increase the 
plausiljility af those edits that eliotinate F IIIOPLA^J ' s complaint. tn 
this *^ay, the abstract forn of the plan helps tn guide the debugging. 

For HflPOLEON. anilysls of (NOT arWE mm)) Isadi fiVCROFT tfl 
consider (IJ adding a rotation as stfltftciRnt 35 to align the secnnii piece 
of the body with the flr^t er {2} placin;) this rotation into Vtt as the 
final statement- Driin^rily^ linear debugging Mould prevent the latter 
Bs It does not respect the inviolablUty of nain-steps. Howe^fer, It is 
chosen here bs cause of the corrohoriting canplaint of FIMDPLAN. The 
underlying cause of the hug is a raalri-ttifrpi error (non-transparent 
insertion) rather than i. prapdratDry-st4j} falluri. Thus, 
(DEBUG (LINE BODY)! produces: 

70 mOHT i5 <^ {setup heading such-that (transparent vee)) 

1.7 GEOHETRiC ICTOWLEDIjE 

Linearity, preparation and intsrrujsts are general c^roblen-solving 
strategies Td^r organizing goals into programs - Hpwever, it is important 
to remenber that dQnaln-dependent knqwledge must be available to a 
debugging system. The aysten nnst Knatt tho semantLcs of the primitives 
If it is to describe their effects « 

The debugger fflUSt also have acceiis to dDnialn-dependent In forma tiun 
to repair main-steps in Mjiich the sut-parts oust satisfy certain global 
relationships. For g^auplQ, TRlCORfiJ has the bug that the triangle is 
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not cLasfrd. Each main-st*;? Independently &chisve& a side but ttie sides 
do not h^ve Che prDjjer global relBtionslilp, DabugQlnQ is £lffl|}lifi«d by 
the n^pUclt Statement £n the podfl thAt; 

i FOR- EACH ROTATION (■ (.DECREES ROTATION) 120)]. 
Cut suppose tha model Imposed nq cvnsi^raintA on the rotations, Then the 
d€^slgn of the rotations would have to fa* d#duc:cd fran such ge n rtn* t r ic 
Unoh'ledge as tl)« fact that H sguaL vEctor* fona g. regular polygon If 
€ach rotation equals 3^0/N degrefls. 

Thfl pieces of an interrupted-step such £S thfl first side of TRICORH 
are not altray^ separited by a itata-traEisparent Jins^rt, (This would b# 
* lfS.5Ll Intirruption. J litsteadn It is possible that mora global 
knowledtia ii needed to understand the proparties of the intervening code 
Which ju^tifiv* the expectation that th? pieces will properly fit 
tc»s&ther. In TRICORN^ the isecontt piece (drawt by statement ^0} must be 
CollinBaT- with the ftrit (drawn hy stateinent l&J, The global propErty 
of the code which just if le;^ this it that equal sides and 12 D degree 
rotatlon-s results in closure, Thui, dabuflglng vinlatlons of globally 
Interrupted-St-aps requires daDaln^dependeilit fcnovledge. • 

Geometric tnowlertge does not rep].ace the- rtifld tar general d«buyginu 
(trategleji: these are sttll very Inportarvt to narrow ths space of 
possible repair-points for correcting a given vlolatiofi and to choos« 
hetwfifin ^It-arnatlvB T:orractions^ Section + diSCUSi^S both typas of 
knowledi^e in greater detail. 



Z. T1IE AHJmrA TOR 

Dsbu^^rlng is lUpOSSlbl^ N^ltho-ut good descrlptitqn of a prngranr's 
purpose and performance^, nVCROFT b«^glns trith the pfti^raa and a modBl 
describing Its intended result. T*n? forns of additional conmc rv t a ry are 
then generated: Perfsraanee Annotation d'octim^nt* the effact of runnlnei 
the progt-aii]: wltlle the- FlAtl explains tlie Intent. This cnmnientary is 
organlzdd as sets of Assertions in t d&tafa^se, bound together inta 
spquencei rf present ing what happened ftnct wliy. Figure 2,1 shows part pf 
the database g^nerftted to describe NAPOLtOlT. The nodes are organized so 
tbat th9 horizontal axis, repitesents tlnie uid Is us^d: Xq an-'iKer such 
causal <]uestlons as what changes cvccurr«d t» v^lch stdtfr variables and 
which cqtd^ w^s responsi.blg fqr thass changes. Similar data structures 
for describing prograas ira used by Fahlman [l^T^l and Sussman [197^J. 

The vertical axis rsprBsents tBlBoIo^lcal abstraction and 
explains the purpose of the cads. Models fit into this descriptive 
fr ame'WD r k ^s the highest Level nf abstraction l they describe the flnil 
goAl Mithuut ties to specific plans or chronological performance- The 
next level i& the plan+ indicatin[| the sub'gnal organization for 
accomplishing tha ncdel. Finally, the talooiogy rasts on a description 
of ttlQ actual perfctrounce of the turtle progran when executed iii A 
particular initial envlronaent. 

MVCR.OFT analyzes 4 proaram by first building a conplete 
performance annotation and then applying the pLan-finder to assign 
purpase; tC the cede. Performance annotation is accomplished by runnlny 
th& user^s ttirtla program in a "careful noda* idiich produces three kinds 
of description. 
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1, Pracess Annotatlcin is a description af the autpitt of thp 

program. Tt consists of a record of th& effftCti of 6X<JCUting 
QflLCh orograia statement, f^r turtles, ttiis consists or the 
creatiori of VB^ctors, VEctDr structures, rotatlonn arni paints. 

Z. Planning A[iv^,ce sugg^jts th« segmsn ta t loFi of the progran with 
respect to dccompiUhlncr the nodal en the basics of &bich 
criteria as global connections* 

3 . DvLiurjcging AdViCe describes suspicious code by caveat cnininents 
which aid in subsequent debugging. 

Details OT ttveS4 three kind^ of JlyirfonHAnci annotation are givsn, beloH. 

The FINDPLAU algorithm U then described In sectlnn i. 



2.1 PROCESS AhllTOTATlDN 

Process annotation provide* a description of thfl output of a 
prograq and its sub'froc«<lur«s in ttrms- of s«rn« language appropriate to 

tli6 purpose For li^ihich ths program >ras designed. For example, the 
performance annotation for an arlthP^etic program nil{]ht l>e in terns of 
ffl&thematicai equations to be satisfie-d at various points in the 
computation LFl9y<3 1967}, For tiirtle progrsos» an obvious choice is to 
produce 4 Cartesian cStserii^ttcn of tiie picture drawn by the program. 
Annotation should rsvsal the basic effects of the code, fres of vagaries 
of inrti-vldiisl progrsnping style. This woul^l include knowing the 
'description of a vector, regardless of iriiather the actual ccxmniand is 
FORWARD, HACK or SETKY . (The last command moves the turtle to an 
absolute position on the screen.) 

Anfiotatioti produces a sequence of frames. A frane is generated 
to describe the execution of each primitive and sub-procedure cali. 
Each frame is a set of assert ions specifying (1) any changes to the 
turtle's state and {2} the properties of any picture eUn>Bint& which have 
been created. The turtle *s state consists of th4 values of th.e global 
variables ihtADlNG, ;POS[TtW and iPtV. Picture eleiients (created as 
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Qoldatcin 2t AiinotAtion 

side #fr&Ct$ of ex-e-cu t in g turtle cnsuEand^) are vectors, rr^tatid'n.i, 
poirvts and structures (ve^tflr sets dr^wpi by recoflnlif^fclE coda segments 

such, a^ sub-proC¥<Ji3res } . 

Z.Z SEflAWTICS FOR TIIRTUL PREHITIVES 

Th* prfl«*ss *nni?tfttiM Is gtnflrflted by inperative senantics 
associated with each turtle priiiitLve. The&6 ^endtltics d«scrlb« the 
performancfl of the turtle command. 

SEflAWTICS FOft t FORWARD rDISTAMCE} iDriWi 4 vector, 

1: VECTOR <-- ( GENERATE-MiWE 'V)) 

;All vertices, rotati-ons, vectors and structures 

:ar6 given unlnnfr nanns to fstUitate later dehugginB^ 

;If subsequent investigal inn r^V4>AL& thAt th4 

jparticular object has been given * label by 

fthe usern then the s)?&t&m nackfl ii replaced by the 

;uspr's identifier. 

i Describe thi Vector In terns ef its direction and length. 

tASSMT (= tniRECTlON iVECTOft) ^HEADlNGJj 

(ASSERT t= tLEN&TH l VECTOR] [DISTAl^CEn 

(AESERf {m (.VISIBILITV iVECTORj ^TEWUPk PENDOW^h RETftACE?) 

;l[>date the State ef the Turtle 

tiPOSJTION <-- jFQRWARH :B[STANCE)) 

iFORWAfitJ- :DI5TAlytE outputs coordinates of th^. new 
Ll^usltion. S#l the turtle stjte varialila iPQ^ITION 
;to this nsH location of the turtle. 

(^roiNT <-- ^GENERATE-NAhJE 'P)) 

tIF the Coordinates are unique ► bllid :POlMT t& 
;a ncK name for this poRition. Tf not, use the 
;old napte for the pD^itlon. Tf a name alread;r 
;e:<ists for this position, record the connections 
joccurring at this point between :VE;crOH an4 
spreyious vactori. 



SF.HANTICS FOR (RlffHT : ANGLE) iRetates th* turtle. 

t:MTATION <— (GE.MEfiAI&-NAKE 'R)) 

:D«scrlbe the Rot&tlDn In terms of its verte^c and d«frtes. 

(ASSERT (= (DECREES ;BOIATI0N> :AM&L£) 
(ASSERT (= (VERTEX iROTATION) :POSiTION) 

T Update the Stats or the Turtle 

(jHEADINQ <-- t^ICHT ^AVGLEj; ;R1(jHI outputs the nem headirrjj. 

At tliE Level oT the prncess, actual numerical values ara 
d4t4irniiln«d for th« above i^ropertias. Becaiasa thesa ass^rtion^ (Icpii^nicl 
upon thif particular state of the initial envirannentr thi;;, is the most 
spociftc, least abstract level of commefttary nhun uunp.^rGd with l(ie 
model and plan. 

Z,3 PLAN-FINDIMG ADVICE 

Although perfornance annotdtlon does not examine the models, it 

can raveal clue^ to the grouping of che usar's program into ntln- and 

preparatory-steps v^hlch aid In finding the plan, 

K Sub-procoduroi that draw visible juh- pictures 
are hypothesized to be EMln-steps that acconplijh 
&oms Dodel JtartL 

2. Naxinal sequences of ^Invisible" pri»ittvBS such 

as (a J vectors dra^n elLher by retracing or wltJl the 
pen up, (b) rctations, and {c) PEULT coranands are 
grouped tnaether ^S pflssihlc preparatory -steps. 

a. naxiinal sequences -of visitjle vector instructions 
plus any '3^lte^^^e^ino ro tat ions are grouped as 

pDssibla aain-steps. 

4. Global connections saggest code beundarles. Th^ls^ 
raaximal sequences of visible vectors can be segmented 
on the basis of such connect ions - 

This segmentation is tentative and nwy be revised in the Light at later 

conslel^ratlon of the model. 

Suppose WAPOLEON was not SUbroutinl^Bd and, instead, tha arms. 



legs and tiead were open -coded ttrC. codcti as ici-llnij sofiunnces of 

pricnit ivE>s rattier than subrDutinized). The above clues wuuld be quite 
useful by utili^iiig ths glabal connections between ttie bod^ aEld Llblbs in 
the picture to sU'Si^est ntln-st^p boundirles, 

■ Oddities in the font of the pro^rdu cftn cre&te a suspicion oT 

bugs. The ^nn^tiit'Dr notices t)i«se viol^tiQns u»lng Flati tanal F.RrO 

Criteria whiich are SaTisitive tq unexpected and apparently errDTieDii£ 

code- Cavc-at comment* are generated deserlbina these cenp taints. 

Rational ForiB Criteria are based upon expectations of simple 

t^ffici^ncy and consist Of nnting ^equeiacej* of contiguous uses of tfiQ 

same primitive, such as FORWAJtD, RIGKT Or PENUP. Ttie annotator 

considers the code to be Add: why didn't the us&r slmpLy coalesce them 

into a single call vfith a larger input or, in th& case Qf PCNUP. include 

only th« rirst Ins true ticn? Ih« answer may be that the user his 

rorgott^n to insert additional instructions. An example would be -wtiere <" 

th« u£«r had forgotten to in sort sevsral 9.lQ[iJ commands ipto a sequetice 

of FORWAEll) instructions- A caveat stating that code may be raissing Ls 

placed ibetween each pair of elements in the sequence of FORWARD'S. A 

violation of rational form occurs In the following triangle procedure 

beOauss th« user has forgotten the first rotation. 

TO TRI 

10 FORVARD 100 <- (caveat annotatar RAT 10NA3--F0B.f1- VIOLATION 

tsequential-priinitlve 10 iOj> 
30 FORV.\RD 100 > 

40 RIGHT 120 
50 FORWARD 1013 
END 

An edit that Inserts a rotation Into such a sequence of FORVARB 

instructicns wgulci Rliminate the rational form violition and therefore 



lie ■preferred iri conpEtitian with atti?r qo rrect i eins which du not explain 

the annotator's c«HpUint, ir tm debugger corrects the pro^raiti by 

eliminating the wmotatifln caveai;, then the underlying cause of the 
error is cons-ldersd %q be "flisslng Code'- 



3. THE PLAM-FIMPELR 

Aft«r pcrfornarics Annotation, the rt»Kt stao^ In describing the 

program is to find ths plan. The strategy Is tni ^ttsinpt initially to 
find a linear plan, l.a. to natch modal part^ i^lth oiodular aain-£t«p5 
and relations tjetwEen nsadsl parta with p rftparato r y- s t p-ps , Thi5 approach 
serves to Halt the search space, but it is. nat adequate t<^ recognize 
interrupted naln-slfps and Insertions, Thes« "non- linearities" are 
suggested ty ii<*p.Mifns afaput the caus« of violations implisd hy the 
conjectured linear f>li.n. These suspicions are thftt the cause of the 
violation is not «in ffrror in the user's pr^jgran tmt a Tnlstaks in the 
0l4Ti-finder'a linear Interpre^tatien of the plan, [f additio'ndl evid^nc? 
can firms tha suspicicin, the; pi an "finder corrects Its linear analysis and 
finds thp Correct global or insertion type of plan. Th.i!^ approach uT 
first pursuing a llnfrar intet-pretatian and only 'debuggiLntf' this 
approach in respnnsa to anonalles is a powerful rea.s.on.ing Bechanl-MTi for 
searching coaplex spaces . As was FVOted in section. 1, the debugge*r us^s 
a sioiilar analy^iis to sinplify Tinding Che proper repairs. 

Plan -finding Qbtains soqi* gulrianc<f fr»in the plctur« and some 
from the pro gram , Tha liL^^'^tll ^tipplias such clufrs a&i 

(.a) gloljal connections which suagost suh^picture boundaries 3 

lb) retracing which suggests inserts; 

and (c) violations of node! stat^mtnts **hieh ar* the-n used both as 
plausibility critaria {to distinguLs.h bstv^esn alternative 
Inter trivia lions} and t-o generate suspicion demons (i^hich look 
for non-llnaar planning structures) i 

The l^ro^ram. supplies guite difreren.t clues about intents This Includes: 

taj iub-prncedure structure which aids in retogn-izing niain-stfips: 

flnd ib) the or<lier in which the picture is drawn which, when combihuil 

with program-tfrltlnfl criteria, suutietts the urdar in Which the 
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ncTdel ptfTKs art accoHpli^hed. 

3.,1, PLftN- FIN DING AS SEARCH 

Finding th4 plan ea-n 134 COFlCQptU'alized as B search of a space of 
"^partial plans", The search he gins with the iflpdfl , the pro gran and tti« 
performance annotation, A [idrtlal plan ti 4n explanation nf aame 
Fraction of the nwdel In tftms of the proSfMi. Given A partial plan, 
Ita dakighters are tTie result pf generating alternative ex^idnatLons for 
one of the reinaining utiassignfirl rwdel parti, A terminal node is reached 
when all af the model parts have b«et1 explained and a complete plan is a 
I»attl from Che root to a tenninal node^ wherein an explanation is. 
provided ffii' how Each model part is achieved r 

A Oartill plan con&ists Qf PURPO SE comments which assign model 
pre-dicates to code, unassigned nodfl parts, OXJOC ta t lon S , th« ImpllOd 
PjLTtial interpret it lon> and deinons. 

PUl^pnSE:;; - These are the basic statesments of a plan and appear as 

■<-" commentary in the NAPOLEON procedures, five kinds gf pyrposps 
are generated by FINDPLAN: accoiapHsh, Iflsertr SCtup, cleanup and 
retrace ^ 

UNASSltiNED nODEL PASTS - The fflOdel speciries a list of parts. These 
are either primitlva picture objects (vectors or rotations) or sub- 
models. An unassignBd part is on* without a PURPOSE Statement 
indicating haw it Is to bfl accovplishtd, 

EXPECTATIONS - These are predictions of which part is expected to be 
acconplished by the ng^:t nkaln-step. They are bd^^d on applying' 
program-writing criteria nf efficiency and simplicity to the miodel- 
Sec the dlscus&ion of Analysis by Synthesis in the next section. 

PARTIAL INTERPRETATIOW - tiDdel predicates cap be evaluated ify 
ordinary Cartesian geometry using the binding of m^tli; I. partji to co-de 

(.which the plan Implies) and aiv aniiotattd description ijf the codecs 
flfTects. A partial interpretation consists oT those nodel 
predicates whose truth value is Known QLven the curre;it partial 
Inlcpprctatlon, 

i>EnON£ " DemiOns are used to explain subsequent code in such a way 
that violations in the partial Interpretation are ellnlnat&d- The 
elialnation results from debyBfllng the system^s linear analysis and 
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r^CD^nlziing the €XiSt«nC6 ar ail intprmpted or InsertBd main- step L 
The pirtial plan lA COmi^lit'ES v<ihen all cf the unasslgmed parts 
are expljiinecl by PURP^^E^. Debugging is fixing the vicUtions af the 
resulting compl&te tnt«rpr«tatl&n. 

3UZ LINEAR Pim SPACE 

Th? ::E>arcitt U neither a itandard! tir«adch nor depth first 

explsratiort of the ^pace. InstEa^t the system initially flss-imres a 

linear structurK to the user's plan, LooXin'S to Assign the parts to 

se^quRntlal cod^ sfr$rments. The ^ssibility that a part is bEing 

accampl ishid by disjoint sepients of cads or by in^^erttons is not 

considEred. mi* greatly constrains ttia s^Aftti spact. Hrajichingn 

however, ii net eliiiiinatedi for a givcTi prograJB, more than one linear 

plan will usually be possible. To choose atDonp the alternatives in this 

Llncir plan space, sevC'ral pla-ustblllty criteria art u^ed- 

1. (Advice) The first is t(j take advantage of user, annotator or 
debmnger advice to InltlSliZ* the puiriial plan space, Ajinotator 
iiftvice orl^iindtes in noticing (1^ sub- procedures that have been 
prE.^vioiisly assuciated with a modf^l an^l (Zi open-coded setiu enters 
idicntified as having a rcinaon purpOSfl on the basis of non-modeL clues 
like pcnstate changps anfl r«traclnH. (See section 2.3. J The first 
produces PURPOSE asstrtlons **hlcn fflrm. the initial partial plan: the 
aeconct SlXiC£5TlOM5 which have the affect of causing open-coded 
s^quances to be traatad as sub-pmcadures. Debug^rlng advice is in 
thff form of ^ request thst the i>l a n- finder supply a new plan that 
does rtot rn^k-e certain hypatheses about the prngrBm, This Interaction 
ariitcs when the debugger finds all editing Strategies for the current 
pi ad implausible , 

Z, (Analysis by Synthesis) Another nethed Is t* consider the inodel from 
the point of VIEW of program writing. This leadi to tuo forms Cf 
ad.yice. The first is to assign sub -procedures to uiorleL parts if 
possible (on tha grounds that the fftOJi'l parts constitute a liteLy 
plan for breaking the picture into Sbb-goals). The second is to 
generate expectations for the order in i^hich the parts arE to be 
acc^omplished r TlliS Is done by observing transitive sefHifinres of ^nr.h 
pradnates as BELOV and CO^Wti^TED in the nodel= The heurlattc is 
that that these sequences represent the probable ordor In which the 
parts are accomplished^ thereby qtnimlflng retracing. 



(StAtic Evaluatian FuncClan) A third aethnd in. a plausibility 
estimate ijf pflrtial plans, Thii ostiwritc is itrnjaly th& number of 
gatisfied model statements and axpecEinns minus the numher of 
vli>late<j model statements and expectations, if tha proi^rjui \s^ b\jts 
fr^e and ttie plan 1^ correct,, then the plausibility number i^ill be 
ina!;iRal. At any Instant in tine, only tho&o plans with the- hlgliest 
plausibility nuifib«r ur« ^^IjulOi^sd. Archer dnalyzing A s to 1 Eijn^rH t ^T 
cocSe^ the plausibility number is recomputed and the active plans arc 
rechn^eji. Tnactive plans are "hung" and ara nut resume'd unle^^ their 
active bretnren become less plausible. 



JL.1 O"0l*W TOE PLAW FOR ^CKHAN 

As an frxarapla, let us consider the prablen of rinding tile plan 

for NAPOLEON, Recall that the procedure isr 

TO »fAPOLEOtl [See figure 1 . 1 

10 VEE 

20 FORWARD lOQ 

4D FORWARD 100 
5D LEFT 90 

60 TRICORN 
EUV 

We shaill {isisume that the VEE sub-'prDcedura has been praviouSly 4iinrt<Dtatied 
and associated with the V oicdel but that TRICQKM and ifAPOLEON have JiUSt 
been defined and their purpose is unknown. By considering sub- 
procedures iiS csndidntES for flCCflmplishing nodel parts [analysis by 
synthesis), TRICORN iS bound tO thfr EQUllRl aadel. fhft result is two 
possible Initial partial plans. These are: 

PARTIAL. PLAN. 1: PARTIAL.PLAM.Z: 

10 VfcE <- (acconplish l?gsj ID VER <- [accomplisb arns) 

30 VEE <- (accoaplish arms) 3D V£E <- taccomjjlish Leys) 

fsO JRiCORH <- (accomplish head) 60 TflLCORN <- CaccDinpIish head) 

Further c&nstraints arft imposed by FINDPLAN's pragram-writing 

e?:pe stations- On the basis of BELOW; FIK'DPLA?J expects: 

(accampLish legs) <"> (iiccomplish amis) <-> (accOQI^liSh head) 

The double arr&w In^Jicates that the sequenct *ay happen in either 

forward or reverse order. Dn thv b^sis of connectivity, th& 



GvldKtein 30 FlncJing ths Plan 

expec tat ions are: 

<accciapll&h lfr3£} <-:^ {ac^onjills]) bodyj <^> (AC<:MdpIlih Keadi) 

Taken together, the result is that statement ID is believed to 
accomplish thve LECS and stateoent iO tlie ARHS, Thus, PMTIAt.PLAN. l is 
prererrB-d. 

ThB code of the program li then considered statement by 
statencnt. Stateinent 2Q ^raws a vector and is therefore helievEd to be 
the BO[tY, It Hight be only a piece of the body but this is not pursued 
yntil thiQ llneir dssumjstion ttiAt Che body it accomplished by a nodular 
inain-^tep is rsjectedL 

£tateQEnts 30 and 60 have already been assigned to the arms and 

tl^ad, r6s[rectiv&ly . A& a result, all of the model parts have bfren 

assigned but statement 40 remains unexplained , FINIiPLA?^ crjns'equently 

backtracks and interprets statement ZQ as only piece of the bcdy . A, 

demon Is created for recognising the body's completion and plan -finding 

r#c4>mia?nc Bs at statemient 30. Statement 4Q sat is Ties this deptciTi sihiCa It 

llraiffi a vertcr that begins at ttie andpoint qf the first piece of tha 

body* The result i* that it is conil^Jti'eiJ (ploco Z body). Thus, wjth 

almost no search, the plan for POAPOLEON is correctly deduced. 

TO NAPOlEOM <- (acconpllsh man) 

10 VEE <- Uccaciplish legs} 

20 FORIJAI^D IQO <- (accnnplish t. piece 1 body)) 

30 VEE <- (insert arms bcdyj 

40 FORWAftD 100 <- UccoQplish tpitc* Z b<»dy H 

50 LEFT flO <~ (setup heading} 

60 TRICQRN <- (accobplish head) / 



^A NCN-LIMEAR PLANS ANtl Stlf CI^[T1C1SN 

This section axplalns ham Intgrrupte^d and In&erted laain-stopa 

are recognized, Uhen F1N0PLAN ^Inds an un^ssigited fiNdtl pert H to a 

S'^goent of code C and t,h« resulting lnt«rprEtatitin iaplleS taQdel 

vlolatlens, tJiifre are thre« possltjle ExpUnatipns; 

1- The code Is in errol*: a bug has been dlscnverRcl. 

2. C is not intended to accomplish 71. Ctiao'se another in terpr-e tatian 
for C* 

^. C accomplishes only a PIECE of H, The remainder of II is achieved 

in pieces. 

Possibility I requires no special action by FINDPLAhl: tho 
violation will eventually he pa-Rssd to RRBUG for correction. 
Possibility Z requires that th« a different linear plan be chosen. This 
Hi.ll occur if the current linear plan becomes less plausibla than 
alter-Tiatlve linear interpratatinna i^hsn comparad in terms of the static 
plausibility function described earlier. Possibility 3f hQi^evern 
repr'gsent^ an error in the plan -finder's linear analysis ol' tht program. 
H«nce, to take account of po**lhlltty 3, dannns are genarated. These 
dfimans ara lonking for belter Inlerpretatlr^ns than the current linear 
plan (irC. interpretations which dp not ijnply as many viaiatiQns). The 
followlnti paragraphs describe the creation of such a riemon in the pLan- 
firtdlrig proc&ss for TRICCRN* 

Suppose FIMCif^LAM ha^; ju^t decided that statement C achie-ves 
model part T1 and thai this results In ^ violation because N is too 
SBialL. FIWDPLAN suspects that fl nay be being accomplished in pieces. A 
COMPLETION depnn U created looking for subsequent code CC Vhlch would 
eliminate the violation If CC ts In t « c p re ted as another PIECE of n. If 
such cod& i.& found, the actl-on of the demon Is to edit the ori^jiirial 
partial plan so that n is- now cpnsldored as being ftchlev^d hy an 
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interrupted main-step, IT ttie <iO^^ 'b&tVf««n Ih^ ple^C^S of the maln-^St&p 

re^twrns the turtle to the exit state of the first piece, thEn it is 

iniArprtted as being an insertiM. COnPLETlON demons Are also created 

wtien a vector ii toQ short to accflnipn5h ^n intended connection. An 

oxaupla occurs In, th^ linear intarpretdtlfln of TRlCDRN shown h^low: 

TO TRTCQRJJ flncorrecE linBAr plaii initially deducBd. 

10 FORWARD 50 <- jaccompllih (side I}} 

ZV RIGHT IZO <- Uccomplish (rot&tifln 1)J 

10 FORWARD 100 <- (accofflpl isTi (side 2)) 

:At: this point in the plan-finding prDcess, the Violation 
;of unequal slde^ occurs. A COMI^LET fOM demon is created 
jthftt Is looking for a vector of length 50 that could be 
] intertireted as the remainder Of {SKI'S 1]^ 

10 R|i5HT 120 <- (accompUsll (rotation Z)) 

JJO FORWARD 100 <- taecompUsh (side IJ) 

sKere fhe violation of (side 1) nnt lieing connected to 
;tslde J) occurSr A second CONPLtTLCM demon is cr&ated 
[thai is Looking for another PIECE af (sido 13 that connects 
E to ( side i) . 

40 BIGHT liO i- (accomjiilisti (rotation 3)) 

70 FORWAPD 50 <- (accomplish ?) 

END 

Doth of the COttPL£T!0N demons are triggered by stateotent 70' r Ttte result 

is. that stateineTit 10 is reinterpreted to accomplish only 

(pi«ce 1 fsid^ UJ and statement 713 is assl^jn^d th4 pur[^ose of 

accomplishing < piece 2 (&ld« U). This prodAicea the correct plan, 

{Other denoms are created in the plan'flnctlns process fnr TRICORN'. 

However, they are never trtnflered and are therefore not aeintidnect . ) 



3^5 SUMilARV &F THE PLAN-FTJJDFR 

The al^iorithB for plem-fintling performi well when: 

{I't The U£Cr suppTi^s advice in Che fdrm oT a pArlldl Man^ 
(2) Thfi urocudure hflS SLihrnuttnea ; 
(3)^ The procQclurft ha& few t>ugi- 

If the prQsrAm is riot subreutinized and is full of bu$s, ttve search 

flr9*fs uninnnag«ai}a« and dirricuLties arL^e in sel«ctin^ the most 
plausible C^AiidlJate . Thll perrfJrniancB is, quite r-ea s-dti ab 1 e in the sen£ia 

that similar stateBKiits ira true of a human prt^hliu solver lnv«ftlgat;ns 
a strange orogran. 



4, THE C|iBk^C|R 

i,.l nOD£L VIOLATIONS 

The manltor is designed tci debuEi laodBl violations . thase ar« 
recognised hy the INTERPRET nwdiilH (see again figure l-fi) which cmnpares 
the out}»iit or a syntactically and seindntlcally correct turtle pr«!qiraiTV 
(I.e. a prog ran that is able to run to codiipl a t ion without request in^ any 
illegal c&fflputaltcinsj to the description of intsnt provided by Its 
picture model, ufin^r the plan ta bind sub-pictures to aQdel pai'tis. The 
r&£Ult is a list or violated model predicates. Ttie prograoi is 
con&ifi^red correct when all of these vioLatinns hava bean eliuilnate^r 

Correcting ■O'dtl violatiorvs is accomplished by using two types 
of procettural knowledge: (1] a collection of general debugging 
strategies for repairing programs and t^) dlrtctloni for fixing 
partit:Ljlar gaometric and logical predicates. Be causa overall sjUi dancer 
Is derived ft^an the do del, we shall call this type at atia Lysis nodel- 
flriven ^^jBUflsing. 

i]L^ PEEUCGIWti AS SEARCH 

A deljugging strategy is a sequence of editing fvommandi whose 
effect is to modify tht progran so that it satisfies its tnod«l. There 
are generally multiple debugging strategies for correcting a given set 
Of violations. These alternative debugging strategies arise Tram choice 
or the repair-points at i^hich the corrections are to be made as i«Jell. as 
of tho fiixact mean ins ^^^^ ^^< user intanded. 

To clarify the Issues which arise in selecting the best 
debugging sequence, it Is useful to conceptualize the problem in terms 
uT a !h?jtrch ne-tiiphor. The space Is that of all possible debugging 



Stratsgleii for correctingi the progran. Each node is a 5ieC of model 

violations: the griffin of the sp^ce is the initial putput of INTERPRET. 

An arc Is nn adit ufhichi which leads to a node eonttlnins tut n«w {and 

Orc^umebly smdllsr) set Of Violations Tdlich are praduced by the patched 

code. Etranchln^ accurs for e&ch potslbla patch far correcting a 

violation- A path ttirough the space constitutes a series of edits that 

trani^rorni the proyfiim to an acceptable fom. 

Recognising the escisten-ce pf multiple posslbilltips for 

correcting a program, it is appropriate to bsK httiat lin«Hledge Is U3«d 

to: 

11) chciose the n^Kt aodal violation to bs detniiided? 

(Z) generate the possible corrections for that violation? 

(3) choose Che most plausible correction? 

Tho following sections answer these (;uestlons. Ordering 

Criteria are introduced for choosing ths sequence Irv which the 

violations are debutj^ed^ A Linear approach curtails the nuHibf^r qT 

possible eelit points Hhich are ioitially considered . The imperative 

scnantlcs of the model predicate* are used to generate possible 

corrections. Plausibility criteria are designed for s«l»cttng aaong 

alternative debugging strateglas. 

4.3 ORDERIK-^ flilLJifLE VIOLATIONS 

Multiple bugs 4re diffi^i^ult to fix. G'ulde lines are require^d tO 
order the sequence in KtiiCh the violations are debut31]Cd- Th«se 
gLiidelines reflect ao uoderstandinsf of dependency relatiortships between 
violations, thereby serving to minlaize the unfortunate occurrence of a 
correction undoing previous rafairs or introducing ne« violgtior^. The 
ordering is done on the basis of preferring td repair: 



{1} bugs In propErties of raod^l parts b^fere bugs 

In relations bEtwEen modsl parts; 

i^i bugs Iri intrinsic properties (or relations J beTcrB 
bu^i in extrinsic properties (or re^litions); 

/ 
land O) l?UBS occurring earliest iti the temporal £6^U6liC« f 

ot execution. 
Thfl fallowing paregriiphs describe the&« critari* and explain their 
nationals. 



4_^3 . 1 Dsbug Prope^tia^ If^^l? Relat ions 

The system debugs violatioins of properties of mociel parts btfore 
roEtalrlna violations of relations Iwtween nodel parts. This is based on 
tti& impartafit Heuristic of firit having a successful thfiory of th« p^rts 
btiTore atteniptind Ah ^Kirldhdtion of th«ir Interactions. This is. mara 
than gaD<l style- The behaviur ef fha interfaces is designed relative to 
the &ntry-aKit states of the code for the miln-steps accmnplishtngi the 
parts.. To deternine the specific state changes to ba made at att 
iiit-urf jtBf the pErforniflntB (►f adjacent fflflin-Stcps must be estabiished. 
Ttius the cQde for sub-pictures uu&t be ri}!«d prior to deciding on thn 
proper edits to the preparatory-steps^ 

Properties of individual raodel pArts include unary aoilel 
primitives [m.g. VERTICAL. HORIZOIJTAL and LINE) as i^ell as User-defined 
sub-nvod«is le.a, EQUITRJ and V), The nost coinnifln relations between 
Hodiel parts are predicates such as AEOVt, BELQU, and CQNi4[i^[:TE&. 

A .^ lZ Debug Intrinsic Bafore Extrins ic Pre dicates 

The Idea hElilnrt the next ordering criteria is tn estimate thd 
ranne of possible Iticatitins in the prcgran at trtiich the repair ni'yKt b« 
padie for eaoh violation. The heuristic is thai] t& fix those violations 



of most-llmlttd scopfl first; both because they are easiest and because 
of licp&rvd&ncy relati-onships. 

Let the sco pe of a. Vlol attD H bs the code betinieen the repair-^ 
point and tht manifeststion-point. For a property HP M), N a reodeL 
part, the nanlfestation-pijiht is the location In the progrrun nt which M 
is ccnipleted and the truth of the statenEnt (P M] can be evaluated. The 
repalT'^point is the Locatlen In the prograa at which the frdit is 
eventually made tD correct the violation. Far a relatfan (R N hi ) , thei 
inaTvifestatlon- point is the iecatlon in th^ pro gran at which both M and N 
have been completed and the relation R can he evaluF^ted. 

This criterion would be pdiiitle^s if there were no way tu 
estimate the scope ef a vlolatlen before entering Into the details of 
debugging, Hoi^everK this is not the case, One Qetho-d for estimating! 
the scope oT a violation is to kncM whether the property of relation is 
intrih&ic to the reston^ible code. 

A property (P A) la Intrinsic to the ctfds far A if it is 
lnde(:»endent of preceding code and entirely due to the tnain-st«^E> for f\, 
Similarly, the relation (R A B) is int rinsic if it is independent of 
cade preceding A, Assuning that A is achieved before B. Repair is 
ainittlified by flxinig intrinsic predicates before extrinsic on&s since 
O) for intrinsic violationa, the possible repair-points aro easier to 
find since they cannot occur prior to the code for A, and {Z) the proper 
correcti&na for extrinsic predicates depends upon tho the code, being 
intrinsically correct. 

In the world oT turtle geometry, intrinsic errors are 
distinguished by being innlepiendent of the frame of references they 
cannot be corrected by translAtlna or rotating the pictures. This is 
because in the simplified environnent of flx4d-instructl4f» tyrtlt? 



proprEuaSi code- gt-oups dhaw rl^U bO<lt«s, Th* illUl«I liHiErface of a 
code group has the effsct of ^stablishins th« origin ai)^ orientation of 
tlie sub^plcture but doBs not afrec-t the lotal relations tmong vectors , 
Topological predicates Un^ariant under transfarnHtlcns that preservs 
conoEctivlty} and gEoniEtric predicates ^nv&rlant under trADSlatlon and 
rotation) are Independent of the fraaa of refaran^fl flTI<t therefore yield 
Intrinsic violations. Bugs in the folloH-ing model priniitlvgE or* alwaj5 
Intrinsic to the code group to wtitch tJi*y refer; OVERl^P. IWSICE. 
OUTSl&E. PARALLEL and CONNECTED. . • 

Extrinsic errors are those affected hy the initial environment 
In which the code group is. executed. The inltl&l eFivironnsrit consists 
nf the bindings of the turtle stats variables -- ;flEADlN5^ jPOSTTION and 
:PIM. ThesQ variables control thi orientitttsn* origin and vlAiblllty of 
the sub-picture a£ wall as its relation to previously drawn parts of the 
picture. Nodal predicates wtilch depend on the Initial ^tate ars 
VERTKAl,, HOfilKONTAL, &EL.OU, and ABOVE. 

Debug^Flnd intrinsic vloUtK^ns first ttnds t« establish the 
proper connections at interfaces, l>ebugging extrinsic relations lliie 
ABOVE the^n be-comes siDpIy a patter of eSitab'lishing the proper heddlng At 
interfaces. 

in the turtle world, the distinction, between intrinsic and 
extrinsic predicates Is particularly eaiiy to naVe; however^ it rernuins a 
useful debugging distinction in other domains- [f a property of a 
pragracn is due to soiDe local data structure [sueh as & bouncl varliible) 
or local control structure <such as * loop) ind is independent of the 
preceding code, then it is intrinsic and worth debugging in private 
before extrins.lc properties {whnse causes ata less easy to Isolate) -ar? 



4...3.1 JJAPOL£0?f's Violations 

The follovrinfl list of Violations fo-r MAPOLEOW is ordered by the 

aljove criteriat 

(Vialatinns of Prnperties of Parts of hJAPOLEO^y) 
( ftn Intrlniiic Viola t ion -- Hanlf-ested in Prlvjtt) 
(NOT teQUimi TRICORN]) 

(An Extrinsic Vialation --^ Not TTantfejted in Private) 
(MOT (tISJE BODVH 

tVtoliitipris of l^^latl&ns t^tw^sn Parti at fJAPflLE-OM) 

(TemparaL Order ~- (l^^Sp itms] accompl l^hed before {arms, h&adn 
(NOT (BELOV LEGS ARHSJ) 
[NOT (BF.IOW ARH.^ HEADH 



4.* FISfDING THE PROPER REPAIR-POINT 

For each vioIatiDn, DEBLKJ ciust fii^d the proper repflir^poiht in 
the prograid at yfhich to insort tht correctioi^. or course, ttifr debugger 
knows that the repair-point cannot follow the code far the parts 
ffl»ntiotied in the viol&tlon but this la hardly a sufficient constraint r 
Consequently, D£0(J<S VSes two I\«yri*tlc5--Privats and Linear Dehugglng-- 
to litnit the possible loc&tl&ni Tor ttie correction, 

4^4._^ Private Debugging 

An initial heuristic for constraining the possible repair^poirts 
for a vidlat«ii property is to Ilntt consideration to the cod« directly 
respionsible fcjr the modal part In question- This is done by running the 
responsible code in^lepnndpntly of tba larger procedure of which it is a 
part. Specifically, the responsible code ii eKecuted with the turtle 
started et the entry state. The violated properties will be manifested 
in this priVAte environment if tha main-step is modaLar. However h if 
there is inter\^eni[ig COJe, I.e. the main-Step 1* Interrupted^ then tha 



linear assumptinn that %h^ caus^ is Intrinsic to thp r e; s pons iii 1 e CQdB 
and not due' to Interact tons aay b« ^ro-AQ. 

If Che vlolatiqn Is man if pit, the code graup is then debugged in 
this slmpllti^di cant«:(t. Tree of th« effiict& of the remainder of th« 
criglnai progrgn, Private debugging Is used to repair the tJirefl 
incorrect rntations of TRIFORM. There srp na complication!! i^Ken tho 
edited jub^itrocedur# i% rejoined tc the JiJAPOLEON sup&r^proc4dure . 

The rfllatlonshii) between the picture dra,wn in private and in 
(Kiblic is simple for rix«d-lnstruction turtle prograiss ±inc& th«; picture 
is a rigid bocly dnd only its orlentatlc^n and origin is affected by ttie 
initial envirnnment . For more CP^plex prog rami;, difficulty occurs in 
finding a representative private envlroiiBent and further research is 
necBiisary. This i* similar tO tlie probleni nf dlagran generation in 
geometry theorem proving and to th« prDbiara of CAse analysis in 
autoRKitlc progrAm veririeationr 

The private repair ma^ nake assunptiens about the entry state to 
th^ qode- ir this happfsn-i, It will be reflected in ASSUME commftrtts 
regarding the entry stat* to the ■ain-Jtep- When run agaii] In tbe real 
conteKt^ any contIict& b«twe«ii aseurnDtlons niad« in private about tihe 
initi&L environment and the actual entry state are themselves debugged. 
This is accoppl li^hed by adding code to acccnplish the assi^mptiqus in the 
juper-procedMro or. If this proves impossible without causing adilitional 
violations, &aclitrac)ilnfl and atteaptinQ m alternative correct icNn in 
j>rivate. 

An example af this would occur If t!h4 model for }^AI>0LEOU had 
dsclared that the bndy oust be vertical. Debugging the body (statements 
20 and 40} in private nvuld result In the a :; isuinp t ion being generated 
that the entry heading must be D or 160 degrees. Tlie code for the body 
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Is them reconslijered in th« context dT the NAI^LLOH super -procedure. 
The actual entry ^t-nte tn stateDi^nt ZP doe^ not have :E^EA[>IMGi equal to 
or 150 dflscflfls. Conseguftntly, the debugger now attempts to add a 
rotation at some preceding pulnt In Ihfi progriiii! to achieve this entry 
iJtatA. This additioTi -Will jn[>2t likely d-gcuf imnied id te ly pi^i^r tA 
statcmcrit 30 ort perhaps, as the initial setup to the WAIKJLEOW program. 
Ttl# debugger chcose^s whether to prefer or LSDk and at -wttich repair- 
point, on the basis of side effects^ miniinal change tP the user's 
pra^rau and planning caveator This set or pl&uslblllty erlt&ria is 
dc-^^crjted In section 4-?. 

the system d.l&D chsch& Tor bid jiidft-^efrscts on coda rDllOHiMy 
the edited sub-group due td A netr ekit state for the edited code. A 
Cla^liup step may be needo-d to eliminate undesirable conseqUenc&S oT the 
private repairs. The modified nain-step nav vloliate protecticn or 
a&SLitnptiDn crniuiientary generated by other edits. IT so ^ the standard 
^rAcilea is to either (U modify the offended edit in llgttt of the neu 
structure for the Tnain-s-tep or (Z) backtrack and correcting thtf ifloin- 
stoj) in private in *oii» alternative way, See sectmn 4.& for details on 
the protection nechani&D. 

Ctccasionally, whan the code Is run In prlva^te, the violation 
does nut occur. This happens because the maiie:-&tep is, not niodulur A1ld 
the Violation is due to code Appearing^ hetueen. pieces oT on Interrupted 
fflairt-ttep. Private debujjgin^ ranains usafulj however, because it 
clearly indicates that the C3use of th» error is in the intervening 
code. {MOT (LTilE BODV)J is an eKanple: the body wh?n run in [»rivatc is 
Indeed a lino. The bug is in the effect of the inserted VEE on the 
heading of the second vector. 

Private debugging is also used to correct intrinsic violations 



of r^latioTis. BRcall that thi definition of aci iTitrlnsIc relatinn 1* 
thai ii is. snlir&lv dut to the cod« betH«en the idtiiJeL parts mentlDiittd in 
the relatiarl. Hencen the repair- point nust occur there. The same 
pr«c9utlQns re<julred when the cod* is rejoined to the supflr- procedure — 
irOr satisfying assumptions, anii possibly cleaning up--iiHJSt b« taken. 
Outside the turtle world where it ntay nat be so easy to dEclde if a 
relation Is Inirlnslc, private debugging can still he attempted. Just 
as for prdp&rtias, ir the vialatlan daes nDt appear in private, then it 
Is kno^n Chat it is not intrlEislc end the systetn can look for causes in 
preceding cctde^ 

4.4.Z llne&r Debugging ojT M[lptl«i3 

Linear DBbugging is a technique for limiting ths possible 
pcpair-points Tor correcting vlolited relations of both the intrinsic 
and fiixtrinslc kind. It Is based upon the assumption that CEBl^ has 
already privately repaired the nain^steps to satisfy thsir properties. 
The linear debugging technique Is te considltr tdilting corrections only 
at preparatory- steps and net internal to th« cede for ths main-stepi. 
Haln-steps dre treated as invloiats black-bo\Qs: their contents need 
neither be knoHrn nor changed. This is basRd upon IhB assuntption that 
th* main -Steps are indtpt^rtdt^n t and that the only corrections nece-SJiary 
to repair reLations is to mofce adjustments at interfaces. This was tTTO 
technique used to debug (BELD^ LElG$ ARH£). DEBUG limited the search for 
tti« prooer edit by not considering the ^dditlau of a rotation to the 
interior of the VEE SUb^procedure. Instead, It restricted it^vlT to an 
analysis of possible corrections at the level nf the NAPOLEOW super- 
proce4iLir&, 

Linear debugging fails when the underlying cause of the 
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viDlacion Is (tue to the cade for ofifr of the ptrts, Iti sucti a case, it 
ts- necessary ta remove the restrlctlDn again.&t niDdifjring tnairi-^tftp!; . An 
RXjinple »^herc this occurs was shown m figure 1.9. The vloiition of iha 
niDutti not being inside the head i* tgiysfl^ll by tht slze of the KTOUth, riOt 
by the interf^ict. 

4.5 IMPERATTVE E^CHfUEDGrJ 

Hqh Is the set of possibL« edits for repAlrln]) n viaiatlAn 
igienerated? The answer lies in the use aT proqoflurAl knowledge 

as^dcidted with thi ffledeL prlinltlves. which provides direction on how to 
Bake the predicate true. The systen has imperative knowledge for 
logical primitives like equality ind conjunction a£ well as For 
geometric prinitlvea appropriate to the turtle world. Tht* imitjeraitive 
knowledge outputs a &et of possible edits whose effpct is to eliEninaCe 
tbe violation. 

In the WApaLEOtf exaapie, [mT itquiTKi micoRii)) is & violation 

of a. Uifir-rrtOdeL, Such violations ire fixed hy recursive entry to the 
(tebugger antt analyzing the code for the model In prlvAten Such 
recursian ultlniataly reduces t1ie dehugginig to flKing violations of nwd^l 
primitives . 

4.i5.:.l JpiPfrativa Knowledae for (ie one trie Primitives 

ITie fallowing discussion describes in a simpliried way the 
imperative knoiiVledise as^ociat^d with several of th4 model prinltlv«Sr 

Let X and Y be vectors and assume that K is accooplished befare Yl 

CL1N£ X V) <-> (.ANO iPAPLALl.FL X Yjf {COJJNECTEP JC Y)> 

Th« Imperative semimtics for Wd directs debug to establish the two 
relations, of PAMLLtL and COHIMI^CTED, These are defined below. 



(PARALLEL X V) <■> {m (DIRECTION A) (BrPECTION E) [MOD ISO>) 

The annotatOP recordi the tUPECTIOtf of vectors. The repair is tn 
ins&rt rotati&ni bftt«efrh the code for X and the code for V so that 
the dlrsction of V becomes equal to th« direction of K (mo^ 160). 

(VERTICAL X) <s> (OR {= [DiRECTlOfy X) 0) {m (DIRECTION XJ ieO>) 

Alt«r pr§e#diTig rot&t.lQ'ns sc as td loake tlie direction of K Q or 100, 

(COfJNECTED X VJ 

Choose a connection point on K {PI) and a cpTinectli^r; point on Y 
{P?r)^ T^e connection point U sonetlhifrs spedfiad in the model] for 
eXAntplBK the USsr aay havE ipdicatfid that it sliould OCCUr (AT 
(.nmOLE (SIDE -,,Hh Then COJilpUte the vector V from PI to P2. The 
ed-lt ii tr> add code for V into an InCerfacr; hntvnon X and- V- This 
wilL have the effect of translating V 30 tJiat Pi Is novfld to 
coincide with P5. 

if the exact position ii unJLnoim, deduce it rron i:<instrdint£ &uch aj 
preferring to effect the code In mininal ways. This is done by 
manipulating Individually the length aod an^gle inputs to tran5:lat^on 
and rotation interface steps (occurring between the code for X an<ii 
the code for VJ and observing if K and Y int^riect ns a Tesult. 
Brarrch in considering alternative allgwaiilfl connection positions, 

(ABOVE X Yj - (similar technique for Mim, RiDHT-OFn left-of) 

To contp-utfl the required correction for a given interface; assume 
that the figure has already hRen debu^iged to be topologieally 
correct--e.g. all of the connections are eerreet. This tnplies that 
the only de-gree of ri-eeddn in interfaces is the heading, 

In considering a given Interface, find the range of headings which 
satisfy the prfidlcato- The ranye is determined by first finding the 
heading of mo^t restrictive meaning of ABOVE -' CENTER ED- AGO Vf. 
wherein the center of gravity of X is directly above Y. Then relax 
this headlny to find the masimum range in whjch losa restrictive 
meanitias of the predicate- -COHPLETELY-ACtOVE and I*ARTLY -ABOVE- -remain 
true:. To select a specific he^diflfl tO Actually edit into the codCf 
Choose the value that sati^flci-s th-e m&St restrictive meaning of 
AQOVE. If there is still a range of passible headings, use the 
flvffragc value, Recflrd the range considered in case later dehngglng 
results in can fl lots and another heading must be chosen. 



4^ S_. 2 The ItllJ^d Bodjf Theorem 

Fixed -in struct Ion turtle proijrABS draw rigid bodies^ i.e. the 
only effect of the inltl.«l rtintiBe environment Is to alter the 
visibility^ origin or orientatign of the frame of reference. This 



ttleoreni ^inplifies the ^^ncratiorr if pcssibls repair edits by al levying 
computntlqTi of tti« reqwired rotation for HORIJOMTAL, VERtiCAL arid 
PARALLEL to hs made only once, indtpernJently oi the point In tne- cods at 
which ths edit i£ t<] ba added. This is useful s1.nEe there are usually 
many points jit whtch patching the code nui5t be considered to fix these 
violations. 

For eKamplH, supposf^ tlis side of a triangle ts to be madfl 
horiZ4nC&i. Th^ required rotation is c Disputed for the $ide. However, 
if the «djit 1& made Inunedlately prior to the code fur the side, thif 
trian^l« Shai^C i^ill be- destri^yed. The rotaticn, however, can be Edded 
to preceding code, rotating all subsequent vectors the ianie anount and 
cons«qu«ntly still naklng tht side horlfontal. 

In general 1 if the correction i& a rotation of the frame of 
refer ence, the edit can he added anywhere prior to the code group to be 
rotatetl. If the rotation is tp change th(> relation between two sub- 
pictur^Si then It can often occur anywhere in th« cod« occuring betide en 
the main 'Steps which accenplish the sub -pictures. 

4^5,5 I.fiyJfrt^y^* !^^!?i?.^„9* *ii t59i^*l Predlci.tes 

The general advice for fixing (■ \^ ^} {P BM is. to use the 
imf&rative semantics for property P to either nalte [f A] equal to [F B) 
or vice versa, For the sinple case nf fixed- instruct ion turtle 
f>roEPi~dr[is, th? change is usually nude to A or E on the basis of which 
occurs lastn This is preferred because of the rigid body nature of sulj- 
jtlctures. Tor eKsmple, suppose A occurs before B. Then adding RtijHT 
fAMGLE before A rotates A but it also rotates B. An opposite rotation 
must be added after A if B i£ not to be affected by the first edit. 
Thus, rising the sub-picture which occurs first conwits the system to 



tMO claanf6£ of th« pro^raiir Of cotirsQ, edit id's the co<d4 t>frror& 6 may 

also roqulre a cleanup because of bad side Bfr^cts but this is not 

in«vitAbIe as it is in tli« first C3S«- This prflferencA is reriected in 

the general rtetrnggifig criteria of avoiding conflicts, minimizing change 

ttt the user's prograa and preferring beneficial side effects. 

Thus, flying equality consists pf^ 

GBneral tnawladgej Either A or B can be fiKed. Prefer to alter the 
unprotected elenent {section 4,6K 

Dcrnia in) -Dependent l^Dwledgai Imperative senantics are provided for 
relating prinitivts to th«ir effects, Ttiest senantics are used by 
the annotAtor to docunent th4> effect ^T i statQi;idnt of code, and t>y 
the debugger tc add the correct code to achieve a desired effect l 
For exaqple, to alter the direction of a vector, the annntation 
ithvantlti fior FoUWARl? {section 2,2] Indlcdte that the tHRECTlON 
property of vectors is equal to the current heading, Ths annotdtlon 
semantics for RIGHT indicate that :HEADIMG is incremented b^ lANQLE 
following execution o-f "RIOHT lANOLE", The conclusion drawn tjy tbo 
debugger, then, i& that either "RIGHT lAAHJLE" is needed to flK th« 
dirsction of & or "RICKT -:ANCiLE* ii needed to fix the direction of 
Ap where :AJyGLt equals the difference beti^een the desired dirtctlon 
and the actual direction. 

To fix (hW CI CZ ,,,), correct all of the conjtmcts. Order the 
debugging attac3^ on the t»asls of the sasta crlttrla used tq order the 
Initial set of Violations. Correct properties of ualn-steps before 
correcting relations between nain^^te-ps - Correct Intrinsic before 
Qxtrlnic predicates. Debug a given group of conjuncts at the same level 
(with r«s]]iett to the preceding criteria] in temporal order. 

See LCioldsteih l^^'JJ for a description of Imperative Aenantlcs 
for other dOdel primitives such as INSIDE, OUTSIPE, OVERLAP, OR, NOT and 
FOR -ALL. 

4^6 ASaUHPTION AND PR OTECT lOH 

D£BUG generates assunption and protection commentary associateti 
Hlttl «A£h repair to Aid in resolving difficulties ^ere m edit C&USAJ 



new Violatictns (tt undOdS the «rrect;S €f some prevlatl^ enlit. As&Umiitions 
about the entry state at th« repalr-p«int describ» expectations on which 

the ImpcrBtlvfl semantics basfld their analysis. Protection comncntsry 

guards th& ced» Troua ths repair-peLnt t« the inanife.s.tatii3Ti^pciTit {thu 
plac^* in the code at which ths sub-picturBS referred to by the violated 
model predicate were ccMnpleteci}, again tccaua« the details of the refiair 
de-fiEFid: upQEi ttlB S t a.tC' idanipulitions^ of tHe Code betMeen the edit and the 
jTiAnl f n.itaticin-point. Protectithn ii intraduc^ji by ^UKsnan in the context 
□ f debugging blocks^ ^arld proaraas (SussTnan L973J. 

A simple exampLe arises Tor the foIlQ'wlng tree program: 

mail TREE 4 See figure 4.1. 

Ml PAJ^TS TOP TRUNIL 

nZ LThlE TRUMK 

M5 F-QUITRI TOP 

HA VERTICAL TRUNK 

ttS COnfLETELV-tEioW n?U«IC TOP 

nc CONNECTED TOP TRUK^IC 

H.7 HORIZONTAL iBOTTOPt [SIDE TOPJj 

END 



TO TREE4 <- (accomplish tree^ 

10 TRIANGLE <.- (accomplish top) 

ZQ RKiHT &IJ <,' (setup heading iuch-that 

(overlap (Interface ststencnt -IQ ) is idle 3 t^p))) 

JO FORWAflP 50 <■- (retrace (side 3 t«p?) 

40 RICHT 45 <- (setup hea^Jing for trtinit) 

50 FORWARD lOO <- (acCQRplUh truq]!,) 
END 

TO TRIANGLE <- (accci^plish equltrlj 

10 FCRWARI> IQO <- C^<='=°^P^ish (side 1 trtangLe)) 

ZU RIGHT liQ <- (acccmiplish (rotation I triangloH 

30 FOfiVAR[> ItHJ <- [att&miollsh i.i\4G Z triangLoli) 

10 RICHT 12^ C" (accomplish (rotation 2 trian^l4>} 

50 FORUAflD lOd <- (accomplish (side 3 triangle JJ 

(cleantip posit ion J 
60 RTCHT UO <- (accomplish (rotation 3 triangle)) 

(cleanup heAdlit^} 
END 

See fiplire 4.£ for th* picture drawn by TREE4 ^fith the turtle starting 

at tho c&nter of the screen and Hith A heading of zero dey^rves. 
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Debugging tliB basa gf Che TOP to be tiarizantal re<iult3 in ttt** 
addition of statement S to rotate the triangle j^ that the ileces^ar-^ 
orlcntall&ri is sstoLiliEhEd. This producer figure 4.3. 

$ RIOHT ^^ ^- (setup heading such-that (horizontil (side 3 top)}) 
OctiijrjyiHg ihB TRUNK to ba vertical by modi Tying tha initial setup ^ 
however, «tvdq!3s ihii corr«etifln [figure 4.'!). 

3 RICHT +5 <- (setup heading iu.dh-that (vertical trunk)) 
The sQlutjlvn Is for the Initial correction of (HOAlZOHTAl ^SfDE 3 TOPH 
to include coiHiientary explfiinlng Its purpose, scope and asiunptions , 
Spccirically, this comefMnt^ry is: 

1. an assumption that the entry State to Statemont 5 is eHEAEHW&kQ! 

{k^m^t (TREE4 £lfllEf1£NT 5} t= :HEADING 8]^ 

2. A protection to any nwd i f i cat i on s of :HEADi|SJ5 from itotement 5, the 
repfllr-pnint, to statement 50 or TRlA^GLEf the nanifestaticn-point 
of tlift error: 

{PROTECT iHEADiJJG UMTEL (TRIAJJntF, STATEflENT 50)). 
Statement 50- is the manifestation-point of th? error since it 
accomplishes (side 3) and INTERPRET is tnen able to recognize that 
a violation exists — the base of the trlangla is not horizontal. 

These comnents force the dehugger to prefer the alternative repair 

Stretepy of [naliino the trunk vertical by edltirig the rotation of 

statftHi^nt 40 tP be P.IOHT 90- 

A second use of this commentary, in addition to preventing 

CflnfllCt& between edits, is to simplify debugiging the procedure if it Is 

ever run in a new environnent. Unsatisfactory initial State values are 

liniBe<ilat&ly noticed by the assumption commentary. Far example, if 

statement 5 of TREE^ contains the assumption that the entry heading 

should be 0, then being run In any other environiaent will uenernte a 

ifiolation. This violation then directs the debugging. 

ThySj previous debugging sessions produce commentary Mtiose 
specificity eliminates compjflji^ qu^^tions of responsibility 4hd 
Interpretlon* The system has, in effectT generflted the 
sn«,pshots of performance which Naur and Floyd utilize to verify 
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programs iFloyd 196?, Naur 156?]. 
The asidiflptlon coPWRTit is pasjetl to the dstugfler as an in struct Ion and 
the result is that crQ-cl& Is add^d prior ts statsiMnt 5 wtiich converts the 
he^idinfj to th« <lfrs.lred vaLUe. 

Often 3. protection conflict can fie resolved. The datmgger is 
sluplj^ r&callRd to achieve the edit which gave rise te the protection , 
tilling irxto c on, i id (j rat ion the new &ntry sr exit state raquirenents* 
This secQn<i call to the dehuggEr iovalves leii effort than the first. 
The confflentary fpnm the first raiialns an^ Indicatei the desired 
Cartesian state te bt achieved at the njanlfestatien-point . If tt»e 
second edit succeeds Nithdut ciittsina unFi sable v id la t ions as side 
ftffects, then, the syatert Has patched its own edit and need not fejoct 
the b^tSiiC form of its currant analysis. 

4.7 DEClDIHti BETWEEN A.LTEpHATIVE D ESUSQIWG B-TRATEeiEJ 

Kore than one debugjijlng strategy is u&uaily available tb fix a 
given viulatlon. Th-t strategies differ with ro&pect tn their estimate 
of the failure poiflt and with respect to the type of correction they 
apply to fix a glvert niJodeL violtttlenx For ex^fflplep the imperative 
scmsntics for BELOW iniJicate the dosir&d direction but allo^ the 
cor recti on to bo added into any prior intarface. In NAPOLEON ^ the arms 
can be made ab^vie Vnt legs Liy adding th« appropriate rotation to ttn& 
beginning of the NAPOLEOM p^rocediire or immed lately full rawing statement 
10, the code for the LEDS. The preferred debugging ilratc^y ^^ the one 
that floes nlninal violence to the USer^S code^ reflects th& abstract 
plan, and fl^es the greatest numbar of violations. 



*^Ll1 Plausibility on tK* &aslj of Side Effects 

The tint critarion for Jiudging the success of a partial 

debugging strategy is an anilysti of tfte iitls frffacts &f the 

COrrectlorLi . The dabugping strategy with ma^clnal tcncflcial Side 

ftffects is preferred. Beneficial side effects OCCUr by eliminating 

addlciondl model viol tt Ions, satis. fying planning expf^ctatlons or 

vliminatlng violations of rttioriAL fDrn. 

Ono night ak why an adit migltt have any frenefltlal iida effects 
at all,. Un't It morft likely to hiv^ bmi side effects and cause 
gth«r violations? Th» answer is that often several viDlations 
are caused by the same arror iti the code. Then one debugging 
strategy will stand out frDn its hrFjtlnren by flKlng this error 
and thereby sinultandnusly curing S9v<sral vi&latlorti. 

On the othar hand, s ana times a correction caus-es addlltional 

Bodol violations. In this cftsa, either the new violations can 

thamselvej be debugged or the dcbygglng stratsjjy must be abandoned;, 

AsskiEni^tinn and pirotection conunt^ntary Ara us«d te help in understanding 

thcpse bad side affects v'tterein ana edit undoes the effoct of saiTl4) other 

debug^lnig edit. If the bad Sld« affect cannot be eliminated, ttien the 

debugging strategy must be rejected. This is the case with a linear 

debugging oT GOODLY. EYES (.figure 4.S). 

The eyes cannot be brought into the head by shrinlling the interfa-ce 

witlTout causing then to ov^rljiip th« no^e. Thus thii d^buyiaing: strategy 

eliniindites one Violation (OVERLAP EVE HEAD) cMily to introduce another 

COVERLAP eve W05E). fha systaifl is forced to Cdnsidar non-linear 

debugging and fiJt the parts themselves - 

4.7*Z Plausibility on the Basis of NlTiiPMl Chiinge; 

Another plausibility critarlon is that of minimal change to the 
usep^s code. A debugging strategy that changes an Input Is preferred to 




GaOGLY EYES 
FIGURE 4,5 

one mat 4d<j.s s.tiit«ii§nt:s; and a s-traterjy tTiat iiiSds stdt^aantj^ is in turn 
preffirrecl tfl flF»t that d«l«t«& then, Th% rationale t* that a repairman 
AhcLlld make minimal chai^gE^ to a system, TIi« qos^l Is to fiK th^ progr^ni 
in harmony with thft iijsr'i intent, not to- redesign ttn Tills caution ii 
fuirther justified by th^ riict that the system, doe^ not falLy Iciicth the 
prorjrammer' s ijitent or plan. Hence^ it pij^t bo h^^ltant tfl make najflr 
rev is ions to his program. 

A third baslf for Chooging botwEsn alternatlvo dobuggi-ng 

Strategies is advice from ttie inhotat&r and pUn-fltider on likely 
errors. The annolator alerts, tha d#buciner to oddities in program 
structure which may bo the U:n.d5rlying cause of smie semantic vldlatlnn 
(section Z.4 3. The plan-rinder fulfiUs tho same purpose with respect 
to Code that cantradicts expectation;^ arising frcm the tvpo of plan p 
The mechanisni or informin.g the debugger of the possib'ly err&neous COiJe 
is through "cavEat" comments. The cofflnauts are noticed htian the 
debug^^r considers the associatEd code In the course oT dsl>ugging sope 
ii»del violation. A repair edit is accor<i«d osttra plausibility by th* 



debugger if tha COrreetton ellnlnttas the CDiaplaint that initiated the 
caveat. 

Caveats generatEd by the plan-Tinder are created by noting 
inse^rtlon^ which arfl not transparftnt, interruptsd-steps which depflnd an 
SOOClfiC runtime enuiroflaents and Lihsar plans in which main-stEps use 
the 5^ni« resource such as an a&sumptiDn about a p&rtlcular stat^ 
variable. In an extended systcn, caveats would be generdteiJ by £uch 
□ ddities 35 iterativE prograns trtiich fail to tvalt and ^-ihared free 
variabl«£, A^ an SKaiople, recall that the arms in NAPOLEON represented 
A non-transparent Insert and that this Information advised th« dedugoer 
to adit the correction into VEE rather thJin directly intq the NAPOLtOli 
super- procedure. 

Cfinunents are U5ed--rather than the Annotater er Plan-Finder 
Hmned lately calling the JJecogger to correct th« v lo la tl&n--b* cause a 
violation oF rational fonD is not a goarantEE oT a bug: the oddity ifiay 
b« heriii.l«££ ar even intended by the pro^raimnEr. Ait ikaniple in whi^^h a 
sequence of FORWARD Instructions arises naturally Is the following 
triangle pro gram: 

TO TRI 

10 FORWARD 58 

zn FtjRWAnr} so 

30 Rir.HT l£0 
40 FORWARD IQO 
50 RTdHT IZa 
M FDRUARD ICQ 
EUD 

Ttie first two FORWARD'S are surprising. HawBVflr+ if this TRI is being 

debugged in preparaticn for belcifi converted to a Crlahjjulaf head with 

thfl rEniainder of the sticX-oan Inserted as statenRnt 15, then the 

a}?[iare>nt violation of ratianal form is ExplainEd. The Utility ot 

cotnma^nt& it that If the code Is not suspected of being in srror by the 
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deljuggflr, the CQiwent has no effect. It plays i role only if OERlJfi 
f Jncls a JivocLeJr viplatlun that c^n pp^sibly be correctect by changing the 
odd COd^, Oh:!^ l.h»n diUti th« Comment eilt^r ifit& ths iinalyiis by 
Supporting such adding plausibility fo debugging strategies that 
Eliminate Its coiBplaitvl of n&n-transp9r«nt insert &r sfrquentlml 
coimmriEnis r 

4k7^^^ Guessing the Culpable Interfa ce 

Even with the restriction to Iln«ar edits, fixing a lorcdicato 
relating tWCN ma in -steps rOAy pr'O^Ce many lio&sLbla adits. Far example, 

Making t^e head above the legs In NAPOLEON could be d^tie by adding a 
tfototlcn et any af several places Jn t\\e: program preceding the execution 
of the TRKORN sub-procedure. Coniequantly, the system initially 
COrLfiders Qdits tn only tvo interfaces -~ the Interface Imnindlately 
precedimg the second raaln-step tirO. cod« for the aodeL part 
acccinlpli&had. last} and the initial setup to the pra^ram. H^e ifunediate 
interfa-ce is preferred on the expeccaticn that praceding interfaces have 
already been prntected In the course of dft&ugglns. The fllofial setup Is 
considered because "UneKpected Runtine Envirdinment" is a corunoin cause of 
errors r Th^ plausibility of these editing points i& then analyjied by 
the criteria described in the preceding lections -- beneficial side 
effects, minimai change, and caveats as well as the protection criteria 
described in the preceding section. If they ir* found Implausible, 
additional interfaces are considered in order, proceeding backuards fron 
th» s*ccnd mil n- step. 



4,3 SUMMAFlV OF nCBUCCrW COKE PIS 

The dif bug g e r ' s Itnowledg* ^JividEs intq two c^tngoriesi gpneral 
dE-'bugping tscKniquE anii :s|p'sclfl[; imperative kciomledge of logic and 

getiinetry^ 

P&buggmg Ttchniqu« 

1, Linear Attack -- First verify main-steps urivatcly. Then analyze 
relatiams in terms of interfaces. Only if dii fllss fails^ nQdify 

main-steps tcf fijc r^latiofis- 

Z. rlausibl« St^arch -- Cotnj^ftrfr alternative debu^^jiiig stratsgies uainsr 
plausiblity criteria oT m.i[iinal changs ta th€ ussr's cade and 
m:sxi[aa], fa^n^ficial side effecits. 

3. Culpable Interfaces -- Prefer alther tha Initial interface or tlic 

IntErfiiCe immeUiiitely fhHce^lhrf th'? bU^c^ed r3adtile. This is b^ssd 
trn the asiSLLmptiDn that the tempnraL attack has already verifiBd 
InteriuHiliate interfaces, 

4. Caveats -* Usa caveat caivsnts generatetl by the Plan-FlFider and 
Annatator to suageit the location of the repair r 

5. Intrinsic versus Eslrlnsic Errors -- Classify ffloael violations as 
intrinsic nr extrinsic an tha basis Of Whether the arror ii 
internal to the CO^Je being eKaminert. Tutrinslc errnrs have limited 
scope and can. be debuiiged privately. 

Q. Handling Multiple Bugs '- debug tho^e vielatians o-f most-lini tsd 
scope first; that is, dehug prnp«rti(!s baferB rElations; then 
intrinsic predicates before estrinstc ones, and finally In tenporal 
order . 

7- Comnentarj^ -- Use caimnentary to eXprC'SS the t^Ur|>(»S6, a£SUhi|> t lon 1 
and $<;Hppe t protection ) of d correction and to notice conflicts 
between different correctiana. 

tnowLed^a af Qeematry and Logic 

1. inpiBrative Semantics of Pradlcates - In addition to standard 

vciriflcatian code, primitives have Semantics thAt SUygest i^hat to 

do to JTiake the predicate come true. Fhis ccnsist-S of procctlur-dl 
kno^le^gi; which e>araines cade and generates edits to make a 
particular gieoraetric predicate trtie. 

Z, Rigid B-ody Theorea - This Iheareni is a preciEE statement Cf the 
erfect Of the initial environment on a segnent nf code for Fixed- 
Instruction Turtle Proyrans, namely that the carte produces a rigid 
body and that the initial envlronaent affacts only the orientation 

anct pO'Siticm- 
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Iniperativ(f Knowledge for Logic*! Predicifttes - ProcftdurRs far making 

cQnjLinctiDn, disjunction^ ng^aticrriF Bqudlity aFid i^i taenib^jrship 
true with jntninHil effort, 



4.9 Cla^sifjg^tion qf flugj 

The Tol Lowing ta;<onoiiu' of bugs suBonrizes the tvp«s of «rror3 

vlllch the systEin corrects ^ 

Lin&nr Mnin-3tep Failure: 

n^nif (istat ion L Failure of iqaiji-step tn accoinpli^h morlE>l 

part in private, inS. when run ludependetttly, 
FIk; (i*rivfttft tiebuHji^ ill's) Repair in. private^ r«iuih and 

satisfy any initial d^^unptioma , 
Exi tNOt ftQUlTR] TRICORNi) in NAPOLEON. 

Prep'iration Error; 

nanir&stationr Violation of relation ibi?t(<4i>«'n mudel i^arts. 
Fi>(r {Linear Debugging) Find culpable interface, make 

edit £ugge.^ted by the iaperatlvfi ^eraantici; for Che 

predic^tOj and protect e))»Vi[nptl4n4 and b*fh*vo»r until 

th« point at which thg arrur i^as manireit, 
Exz See Unsxpected Runtime Enviranaent and Lacal 

Prfiparatlon Errors 

Unexpected Runtime Environment; ttJfP* of prtparatton falLur*) 
Man.ir«statlon: VloLatlra du« ta faii^e A^-sumptidns O'f 

the entry state to progran. (Program does succeed In 

certain environmsnts 3 - 
FlK; Mi in initial setup ^hich converts the dctuol frntry 

state to the desired entry state. 
Ex: (iJOT (Bf.LOW LF.DS Aflfl^)) In .^APOUON, 

Locsii Preparation Error; {typ* of prflpor<itiwn arrttrj 
Manifest at lam Violet inn intrinsic to the prngram^ 

and not dependent on the Initial environment. 
FlK^ nidify state appropriate to the imperative .aensntics 

for the violated predicate. 
Ex; (IIOT [VERTICAL TRUMJJ in TKEE4, 

No^n- Linear Tiain-Step Failure; 

flanifestatiDTi ; Nain-step succeeds in privati^^ 
Fi)t! See resnuree conflicts, insertion errors, 
and fllqlial errors described lulowr 



DnconsldEred Secnnd'OrdEr Constraint on naln-step: 

(type of non-llncar pam-^sn^p failure) 

Pta.nifest3tii3n4 Vinlatian of a property of JUPdel part 
not detected Jn private, hai^lfested by analyslji 
of a relation between thfr ndin-st«p and iotas 
other it\i>il6l ptrt. 

FLXi Nodify main-step in sucti d w>jy thai violaticin is 

corrEcted while Che firsE-arder description of propErtios 
asserted In the niadel Is still satisfied. Guidance Is 
provided by the imperative senantics for the predicate. 
Examples of *uch transformations are dilation and 
rsf lee tion . 

ex: (MOT (INSIDE nOUTH HEAD)) in B IG . ?101J i H . 

Resaurce tonfllct: (type of non-linear naln-step fillur'S) 

(nBntinned for coDipleteness ] rtCt handled by debugger.) 

flanlff?station: Vlnlation of property af part 

descrlDed iii wotlel which was not e>ihiDited in private, 

FixL So-me asEunption tnjide whem run privately lA beiny 

violated in public. Such an a^ sumption rould be the 
availability of a given resource, e.g, a free variable. 

Ex: Attempt tn correct both {VERTICAL BDDV) and 

(HORIZONTAL (&I[>E TOP)) in TREE* by modifying the 
initial Interface statement 5 (section 4.6) 

Insertion Error: ( tyipe oT non-lin<!r4r oain-Step failure) 

Hanifestat ion : Kain-^tep failure not indicated itl |triva.t4 
with the additional [Element that a caveat CDiimient 
^'enerated by tCi« plan-Tinder Informs the deb'USj^ier 
that the code group for the nain-step surrounds ari 
Insert which is not transparent - 
Fixr Hake insert state -trans pa rent. 
Ex- ^^"0T (LINE BODY)) in IfAPOLEDFl. 

Global, Errors 

Manifsstation: JTbdel part accomplished non-local ly fails. 

FIh: Find relevant theorem which was the basis of expect irg 
the glob'til plan to sur-C^Eid. Fjpd as:£umptions made by 
theoraa which were not Justified. Make these as-sumptlons 
true . 

Ek: (NOT (LINE (SIPE I IFICORMHS in NAPOLEON. 



5. CpMCLUSiQHS 

5^ 1 TOP-lEVEl' DEBUGS INC OUIDAttCt 

Tti? top'level organization of ■□deL-driven debugging is to ^rder 
the HUD del violations and then prcceed to fix them in turn. This 
tcdhniqufl makaa the basic aisunptiuii that $]uidAncfr in rising th« pr&gran 
can be ohtalned hy analyjcing the specific details wherein tins picture 
failed to satisfy Its dflscrijUrion . AltBrnatively, tap-l«VQl ^uidiince 
CAN be obtained through: 

1. i t ructu r&-driven debugging - insight into tlie form of prngnami, 
e.g. iucli structural considerations Si recursive and Iterative 
control patterns and gl&bal versus local variable scope. 

2. evolution -driven d^bu^jlng - the svolution&ry or editing history 
of the user's cede l 

3. pr^cess^driyen debugging - th«: abstract fom of ih« process at 
th« tinw ef the error t^usstnan 1973 J. 

A more COdpIete debugging systen would eichijblt all of these foms of 

directlen. 

S.a OEMERALIZAB ILITV OF qEBPCGJNQ Tl£y?!:TS!J£a 

Ttie minl^Herld ef prograns against iMhlch this analysis of 

debugging is tested is that &f fixed- instruction turtle procedures. 
irhes& aroK of course^ a partiqiilarly sinple tom of prograo, Th&lr 
simplicity allows the Imperative semantics for the geonetric priiiitLvfts 
to utilize the Rigid Body Thedrem, justifying the sane state change to 
different interfaces to correct a given bug^ 

The debugging techniques used to handle ftvan these simple f 

programs arii by no neans exhaustive. Ueverthelass, it is worth noting 
that rta,ny of the techniques utilized by the nodel-driven detiugg-er are of 
brca^ ADpl icatiott r an initially linear analysis, the need to or{ler the 



Bttactc on muiltlp^le bugs, ccmpetence to cope with alternative (j^t^iigging 

strategies- -thcs« we useful regardless of the nature ef the t^p-lev^i 

(Mr«ct:lDn or tTie ceropleMty ef th* prograa, 

Thie chr>lc« vT plane jicicimetry ai thfr S^BuntiC d«tl&in tot ttVCROFT 

was not AccKlfrntal. Gtoaatry aUewa the use nt a Cartesian annotAtor 

and a powfirrul nwdel Ignguago Ter specifying spatial rtlstidns. Other 

doinains may ncit be suacBptlble to a ttV CROFT- 1 Ike apprciictt bacauae of the 

laclE of pDi^&rful vfays In which t« docunent the effects of the program 

'and the lack of a g:ood model language, however, it 1± worth, noting t^tto 

points: 

I, spAtial norfels are very Inportiint fflr prograniming in 

appllca.tlons b«vond graDhicSr [This is r«rl«cted in the uriy 
pfQgraiimiers refer to nLemory, i tacks and data strnjctura^ in 
spatial ways . } 

and 2. programs planning and debugging Involva techniquss of broad 
applicability but cannnt b^ (entirely dcmE in the absence of 
domiiiin^depgjKlBnt khoWl^ilye, 

§rjt EXTENSIONS 

Th« dtslgn of HVtROFT reduired. an investigation of fundame;ital 
proCil«ffl solving! lssu«s including description, simplification;, linearity* 

planning, debugging and annotation. HYCROFT, ho^'sver, is only a first 
■Step in understanding these ld«as. Further inv-astigatlon of more 
coHplex programiK and of th* seinantlcs of different prottlen domains is 
necessary. It is &lso ei^entidl to analyze Additltinal planning concepts 
such as ord&rtng, repetition and recursion as well fis the corresponding^ 
debugging technlqueSr Ultimately, such research will surely clarify the 
lea Thing process in both tfian and BAch lives by providing an understanding 
of how they correct their OMfi procedure^.. 
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